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1. Abstract 


Policing in Europe has become more complex, due to the nature of organised crime being 
more and more trans-national and a growing Europeanization in policing as a result of the 
creation of European agencies like Europol and Eurojust taking over activities which before 


the Lisbon Treaty remained within the sole responsibility of single Member State. 


Informal law enforcement cooperation between Member States is being transferred into 
formalised cooperation by European agencies with a specific mandate and specific powers. 
This development also requires a mechanism to streamline national and European law 
enforcement priorities. In 2005 the United Kingdom proposed the European Criminal 
Intelligence Model (ECIM) as the tool to achieve this task. In general terms the ECIM is 
based on the principles stemming from the concept of intelligence-led-policing as proposed 


by Ratcliffe (2005). However, until today the implementation of the ECIM is not finalised. 


This dissertation will address the conditions for such a model to be successful, especially 
with regard to the operationalisation of strategic findings at EU level within a national or 


trans-national setting. 


In this regard, the question of the meaning of ‘intelligence’ for the ECIM is examined, 
especially taking into account that the concept of ‘intelligence’ in law enforcement still is a 
rather new discipline. In addition, this thesis will discuss the societal framework in which the 
ECIM is to be deployed with a focus on the respective consequences if our society has 


changed from modern to a postmodern society. 


In relation to the ECIM a reflection on this aspect is of crucial importance as a shift in the 
societal paradigm would also question the value of a ‘grand narrative’ like the ECIM, 

a single, monolithic tool that would be able to address the problems in tackling trans-national 
organised crime as if made from one piece in a European context which is defined by 


diversity. 
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2. Introduction 


This thesis takes a critical view on the latest development at EU level to harmonise the efforts 
to fight organised crime in a trans-national context, the proposed introduction of the 
European Criminal Intelligence Model - the ECIM. A specific focus will be on the link 
between an EU model and national law enforcement requirements. The review is based on 
the assumption that any successful strategy to tackle organised crime needs to impact on the 
operational level. Therefore, the thesis also illustrates the link between strategy and 
operationalisation and discusses how to make this link work. The potential success of the 
implementation of the ECIM is a core aspect of this thesis. However, any real impact of the 
ECIM is dependent on the societal framework such a model is embedded in. Therefore, the 
thesis will also reflect upon the possible success of the implementation of the ECIM by 
considering current societal developments, especially with regard to the potential shift from a 


modern to a post-modern society. 


Introducing an ECIM as a trans-national instrument that is supposed to turn its findings into 
operational activities might have an impact on existing data protection regulations within the 


EU and in Member States. This facet will also be considered as part of the thesis. 


Since the term ‘organised crime’ came into existence law enforcement and political decision 
makers are searching for the appropriate mechanism to effectively tackle organised crime. 
Organised crime is still a rather new concept within the history of law enforcement if one 
regards the Code of Ur-Nammu or the Code of Hammurabi as the actual starting point for 
‘modern law enforcement’’. The idea of attributing the concept of organised crime to a 
criminal activity was first introduced in the US at the end of the 19th century. However, there 
was no specific definition attached to it. Two decades later, during the time of prohibition the 
term ‘organised crime’ was used to describe the development of illegal markets in North 
America. In the 60ies and 70ies the concept of organised was mainly associated with the 
Italian mafia. Only in the early 80ies the definition of organised crime moved away from the 
mafia perspective to a broader definition focusing more on enterprise related aspects with 
rational operations aiming at obtaining profits through illegal activities. At around the same 
time ‘organised crime’ as a specific phenomenon started to emerge in Europe, again primarily 


associated with the Italian mafia. Unsurprisingly with Italy as the first country to enact 


' LW. King, The Code Of Hammurabi, Kessinger Publishing, 2004 
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legislation to tackle (mafia-style) organised crime. Germany was then the first country to 
further elaborate on organised crime, introducing a first law-enforcement driven definition of 
organised crime in 1986. By the end of the 90ies the United Kingdom and The Netherlands 
also provided definitions of organised crime based on their national perspectives.” 

These developments show that organised crime initially was confined to the national context, 


which can also be seen when taking a closer look into the respective definitions. 


What came more and more into play was the realisation in EU Member States that organised 
crime started to develop into a trans-national phenomenon. Organised crime groups were not 
only active in one jurisdiction. Several illegal commodities ‘administered’ by organised 
groups were produced outside, had to be brought into a Member State via other Member 
States before they were finally ‘distributed’ to the customer (in most of the cases drugs and 
counterfeit goods). In short, effective tackling of organised crime was not to be achieved by 
the means available in a single Member State only. The trans-national nature of organised 
crime made it necessary for Member States to cooperate. Besides informal cooperation the 
European Convention on Mutual Legal Assistance in Criminal Matters is the most known 
instrument that was developed to encourage the cross-border exchange of information.’ 
Mutual legal assistance was vital for having a successful trial against organised crime groups 
that were active in not just only one Member State. This development happened at the same 
time when European cooperation reached a new level. What had started as the European 
Economic Community (EEC) or the so-called common market slowly but surely transformed 
into the European Union. The EEC was an international organisation created by the Treaty of 


Rome in 1957. 


The main aim of the EEC was to promote and establish economic integration, including a 
common market, among its six founding members: Belgium, France, Italy, Luxembourg, 

the Netherlands and West Germany. Upon the entry into force of the Maastricht Treaty in 
1993, the EEC was renamed into the European Community (EC). This was also when the 
three European Communities, the European Coal and Steel Community, the European 
Atomic Energy Community, and the EEC, were integrated into the first of the three pillars of 
the European Union (EU). The European Community existed in this form until it was 


abolished by the 2009 Treaty of Lisbon. The Lisbon Treaty merged the EU's former three 


For a more detailed background regarding the development of the concept of organised in the USA and in 
Europe see C. Fijnaut and L. Paoli (eds.), Organised Crime in Europe: Concepts, Patterns and Policies in 
the European Union and Beyond, Springer, 2004 

European Convention on Mutual Assistance in Criminal Matters, Strasbourg, 20/04/1959 


Page 8 of 146 


pillars and established that the European Union would replace and succeed the European 
Community. Article 47 of the Treaty on European Union (TEU) explicitly recognises the 
legal personality of the European Union (EU). A ‘re-shaped player’, stronger than before 
joined the pitch. Article 85 of the Treaty provides for the gradual strengthening of Europol, 
enabling the Council and the Parliament to further develop the missions and powers of 
Europol under the framework of the ordinary legislative procedure. In this context the Treaty 
of Lisbon specifies that new tasks could include the coordination, organisation and 
implementation of operational actions. In addition, Article 71 introduces a standing 
committee to be established within the Council in order to ensure that operational cooperation 
on internal security is promoted and strengthened within the Union. 

The committee (COSI) is tasked to facilitate coordination of the action of Member States' 


competent authorities. 


Before the Lisbon Treaty it was the prerogative of Member States to deal with questions and 
approaches related to internal security. These issues were dealt with in the so-called 
intergovernmental ‘third-pillar’, outlining that the decision making power in this pillar 
remained at Member State level. To tackle crime and organised crime Member States had 
already gone through a variety of different models like problem-oriented policing, 
community policing, ‘broken windows’ policing, hot spots policing, ‘pulling levers’ policing, 
evidence-based policing, third party policing, predictive policing, and Intelligence-led 
policing.* Especially intelligence-led policing has been and still is regarded as the most 
promising approach in law enforcement as the model offering the best tool to effectively act 


against organised crime. 


The researched European Criminal Intelligence Model (ECIM) is based on the principles of 
intelligence-led-policing, focusing on a Threat Assessment component as the main instrument 
for strategic decision making. The assessment is meant to stir effective operational activities 
based on the identification of the ‘most appropriate’ targets. Strategic intelligence used and 


processed in the ECIM is supposed to drive operational activities. 


The ECIM goes a long way. As Simon Robertson put it in the 1997: “Strategic intelligence 
focuses on the long term aims and objectives of law enforcement agencies. It typically 
reviews current and emerging trends to illuminate changes in the crime environment and 


emerging threats to public order. It draws upon a huge variety of information from both 


* This list is not exhaustive but highlights the fact that law enforcement has taken quite some efforts to 


develop effective counter-strategies to deal with crime, including organised crime. 
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within and beyond the law enforcement universe to identify opportunities for action and likely 
avenues for change to policies, programmes and legislation. Although operational and 
strategic intelligence analysis have different aims, they are mutually dependent and cannot 
be carried out in isolation. Attempts to separate them, or to foster one at the expense of the 
other, will result in a fundamentally flawed intelligence programme and a failure to generate 


é Mo es 5 
meaningful assessments of criminal activity.” 


It took another 7 years for the intelligence- 
led-policing approach to surface in relation to organised crime. The EU Presidency’s 
Conclusion of 8th of November 2004 state: ‘With effect from I January 2006, Europol must 
have replaced its "crime situation reports" by yearly "threat assessments" on serious forms of 
organised crime, .... The Council should use these analyses to establish yearly strategic 
priorities, which will serve as guidelines for further action. This should be the next step 
towards the goal of setting up and implementing a methodology for intelligence-led law 
enforcement at EU level”.® In the second half of 2005 the United Kingdom introduced the 
European Criminal Intelligence Model for the first time during its Presidency of the European 
Union. Although the initiative was generally welcomed not much did happen afterwards, 
except for Europol to develop the EU Organised Crime Threat Assessment (OCTA) in line 
with the requirements referred to above. In 2010 the Belgian Presidency initiated and 
finalised project Harmony, a project aiming at developing “a generic European Criminal 
Intelligence Model bringing together the existing instruments and strengthening Europol’s 
central role’. Project Harmony introduced a paradigm shift, moving away from a Member 
State driven agenda towards a more EU focused perspective in tackling against organised 
crime. Project Harmony incorporated the essence of the Lisbon Treaty, acknowledging and 


promoting a stronger Europeanisation in the area of law enforcement. 


From this perspective it seems that the transition has been rather smooth, following a natural 
path, mirroring other developments pointing towards an EU with more responsibilities. 
However, a closer look from a practitioner perspective reveals that this transition is still 
rather wishful thinking. Operational law enforcement in Member States still follows 
traditional ways of thinking, focusing on national needs and tangible operational results. 
Even project Harmony with an agreed timeline for implementing the necessary ECIM 
framework at national level has so far not managed to bring a European strategic perspective 


and a national or trans-national operational perspective to beat in the same rhythm. 


° International Association of Law Enforcement Analysts (IALEA), Intelligence-Led Policing - International 


Perspectives on in the 21st Century, [ALEA, 1997, p. 23 
® 14292/1/04 REV 1 CONCL 3 


Page 10 of 146 


Therefore, focusing on the ECIM concept and its implications for law enforcement agencies 
at national level is a core subject for this thesis. Strategic analysis and operational activities 
have to work hand in hand. For the ECIM this means that the model can only be called a 
success if strategic findings at European level are operationalised in Member States. 

This thesis addresses the question to which extent the ECIM is able to produce or guide such 
operational successes, respectively what is needed for the ECIM to promote such a success or 
where the limitations are. As the ECIM needs to direct operational activities there will be a 
need to process personal data, at least at national level when strategic findings are turned into 
criminal investigations. However, for the time being there might only be the need to consider 
respective data protection requirements as a side issue as the link between the ECIM as 
strategic tool and operational activities in Member States is still weak, reducing the 
possibility for processing personal data within the current ECIM framework. Once the ECIM 
becomes operational, triggering criminal investigations at national level data protection 


requirements have to be looked into in more detail. 


To consider the ECIM and its potential impact for law enforcement within the EU without 
reflecting on the societal context law enforcement is embedded in would not provide a 
holistic perspective. The actual perception on what law enforcement can or is able to achieve 
seems to have changed over the last decades. Law enforcement and political decision makers 
still seem to look for the ‘great narrative’ when it comes to find the answer in how to tackle 
organised crime most effectively. The ECIM is such an example. The underlying assumptions 
are very much attributed to a modern understanding of the world today. It echoes the idea of a 
world-formula for law enforcement. Over the last couple of decades this modern world view 
has been challenged by a post-modern perspective. Originating from art and architecture the 
post-modern perspective has been extended to a societal concept of postmodernism. 

This thesis will not focus on an in-depth discussion to decide if we are living in a modern or a 
post-modern society. The thesis will also not focus on the discussions if postmodernism 
would be a new epoch or a necessary evolution of the modern perspective. 

Nevertheless, there are indicators that show that the ‘great narrative’ which is challenged by 
the post-modern perspective might not be able to provide a satisfying answer to all open law 
enforcement related questions. Therefore, this thesis will examine the potential success of the 
ECIM as a common approach to tackle organised crime in a European Union of 28 individual 
Member States in the light of a developing post-modern societal setting. The need to reflect 


more on such a setting is underlined by looking at Member States as divers individual entities 
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with different histories, societies, constitutions, geographical and political peculiarities, 
legal systems, law enforcement agencies, and very country-specific perspectives. Based on 
those individual differences Member States define which crime needs to receive the highest 


priority when it comes to the respective counter-measures. 


In sum, this thesis will critically discuss the potential success of implementing a European 
Criminal Intelligence Model in light of national priorities, taking into account societal 
developments that might point to more ‘fragmented’ solutions required by a post-modern 
paradigm. As there are also potential data protection implications when strategic findings are 


translated into operational activities these aspects are also discussed. 
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3. Research Methodology 


“Not everything that can be counted counts; and not everything that counts can be counted.” 


(Albert Einstein) 


3.1 Research method 


Whether theory or the data should come first is a question that delineates much quantitative 
research from qualitative research. The basic difference between the two is the starting point. 
Quantitative research nearly always takes off from a theoretical perspective (Bryman, 2004)’. 
On the other hand qualitative research opposes the need of having a theory before data 


collection and data analysis. 


In quantitative research the approach tends to be deductive, which means that valid premises 
lead logically to valid conclusions. It begins with a theory or hypothesis which is then proven 
or refuted by empirical testing. It uses deductive reasoning where. Quantitative research 
makes it possible to derive context-free generalizations. Qualitative research is exploratory 
and hypothesis-generating rather than hypothesis-testing and the process of building 
hypotheses and concepts is inductive. Categories emerge from the data rather than being 
identified beforehand by the researcher. Hypotheses are developed from the available details 
to explain the research question. These hypotheses are time/context-bound and based on 
particular individuals or events (Lincoln and Guba, 1985).° Where quantitative research is 
primarily concerned with measuring and finding facts and causes, qualitative research focuses 
on describing meaning (verstehen). It is also more concerned with describing processes than 


in measuring outcomes (Patton, 1990). 


Qualitative research takes a phenomenological approach, with the theoretical component to 
arise from the data. Glaser and Strauss (1967)” elaborated on this approach which as a result 
has become to be known as ‘grounded theory’. According to Glaser and Straus (1967) 

a theory should not be superimposed on the data at the outset but follow from the researcher's 
engagement with the data and its context. Grounded theory uses qualitative research methods 


with the aim of generating theory which is grounded in the data, rather than testing existing 


A. Bryman, Social Research Methods, Oxford University Press, 2004 

Y.S. Lincoln and E.G. Guba, Naturalistic Inquiry, Sage Publications, Beverly Hills, 1995 

B. Glaser and A. Strauss, The Discovery of Grounded Theory: Strategies for Qualitative Research 
(Observations), Aldine Pub. Co, 1967 
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theories (Strauss and Corbin, 2008). Glaser (1992) noted that grounded theory is useful for 


research related to human behaviour in organisations, groups, and other social set-ups. 


Charmaz (2005)’° suggests that the application of grounded theory leads to data collection 
and theoretical analysis going hand in hand, to support each other in an interactive process: 


“grounded theory methods consist of simultaneous data collection and analysis, with each 


informing and focussing the other throughout the research process’. Easterby-Smith, Thorpe, 


and Lowe (1991)'' propose to use grounded theory to develop theory from available data 
through comparisons as a result of looking at the same event or process in different settings 


or situations. As a consequence, quantitative and qualitative research methodologies differ 


beyond the way data is collected and processed. They also differ in their fundamental 


conceptual basis. 


The following table provides a short overview outlining the fundamental differences between 


qualitative and quantitative research (Patton 1990; Chisnall, 2001):" 


Qualitative Quantitative 
Inductive deductive 
Subjective Objective 
impressionistic conclusive 


holistic, interdependent 


system independent and dependant variables 


purposeful, key informants 


random, probabilistic sample 


not focused on generalization 


focused on generalization 


aims at understanding, new perspective 


aims at truth scientific acceptance 


case studies, content and patterns 


statistical analysis 


focus on words 


focusing on numbers 


Probing 


counting 


Communicability/Consistency/Transparency 


Validity/Reliability 


'0 K. Charmaz, Grounded Theory in the 21st Century: Applications for Advancing Social Justice Studies, 
in: Denzin, N.K. & Lincoln, Y.S. (eds.), The Sage handbook of qualitative research, 3rd ed. pp. 507-535. 


Thousand Oaks, Sage, 2005 


Sage, 1991 


M Easterby-Smith, R. Thorpe, A. Lowe (1991). Management research: an introduction, Thousand Oaks, 


M.Q. Patton, Qualitative evaluation and research methods, Newbury Park, Sage, 1990; 


P. Chisnall, Market research, Berkshire: McGraw Hill, 2001 
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Answering the research question required an in-depth understanding of the context, which is 
best addressed by a qualitative approach (Creswell, 2009)'* informed by pragmatist research 
philosophy (Badley, 2003; Creswell, 2009). '* Qualitative research aims to understand a 
complex social problem in its natural setting (Denzin, 1994; Creswell, 2009). Qualitative 
methods focus on the why and how, not just on what, where, when. Pragmatist researchers 
reject the competing nature of quantitative and qualitative epistemologies (Pring, 2000). 
Instead, pragmatist researchers favour choosing the appropriate methods for a given problem 
or question (Creswell, 2009). Qualitative methods are useful for understanding the research 
question of this thesis due to the desire to understand actions, situations, and problems 


(Creswell, 2009). 


The thesis also uses case studies as a useful tool for understanding a situation within its 
context. Yin (2003)'° describes the use of case study as being based on the desire to 
“understand complex social phenomena’, while keeping in mind “the holistic and meaningful 


characteristics of real-life events”. 


3.2 Document analysis 


Document analysis is a systematic procedure for reviewing or evaluating documents, both 
printed and electronic material (Bowen, 2009). '© Documents contain text (words) and 
images that have been recorded without a researcher‘s intervention. By examining 
information collected through different methods the researcher can validate findings across 
data sets, reducing the impact of potential biases. Atkinson and Coffey (1997)'’ advise 
researchers to consider carefully whether and how documents can serve particular research 
purposes. Documents can provide background and context, additional reflections, 
supplementary data, information on changes and developments, and verification of findings 


from other data sources. 


J.W. Creswell, Qualitative Inquiry and Research Design - Choosing Among Five Approaches, Third Edition, 
University of Michigan, 2009 
G. Badley, The crisis in educational research: A pragmatic approach, European Educational Research 
Journal, vol. 2 no. 2, pp. 295-308, 2003 
J.W. Creswell, Research design: Qualitative, Quantitative, and Mixed Methods Approaches. Thousand 
Islands, Sage, 2009 
'S RK. Yin, Case Study Research: Design and Methods, Thousand Oaks, Sage, 2003 
G.A. Bowen, ‘Document Analysis as a Qualitative Research Method’, Qualitative Research Journal, 
vol. 9 no. 2, pp. 27-40; 
Z. O’Leary, The essential guide to doing your research project (2nd ed.). Thousand Oaks, Sage, 2014 
P. Atkinson and A. Coffey, Analysing Documentary Realities. London, Sage, (Chapter 4), 1997 
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Moreover, documents allow for the gathering of data when events are no longer to be 


observed. 


Qualitative data collection, collation, interpretation/analysis and reporting included official 
academic and practitioner’s publications, professional journals and official magazines, 
national strategic papers related to law enforcement, books, and political documents 
published at EU level In addition open sources and information available online via the 


internet is used. 


For the purpose of this thesis the information obtained was then combined and synthesised 
also by making use of the experience of the author as an actively serving police practitioner at 
Europol, at the same time drawing from the experiences gained when serving at national 
level. Additional benefit is provided based on the fact that the author has extensive 
experience in operational case handling, at strategic level an in preparing political decision 


making. 


3.3. Interviews 


Qualitative research interviews seek to cover both a factual and a meaning level, though it is 


usually more difficult to interview on a meaning level (Kvale, 1996).'® 


In the author’s thesis face-to-face interviews using semi- structured questionnaires were used 
collect additional data to be used for the study. The aim of interviewing was to identify issues 
related to the research questions. According to Mouton (2006), “the researcher has a list of 
questions or fairly specific topics to be covered, often referred to as an interview guide, 

but the interviewee has a great deal of leeway in how to reply’. Additional questions that 
were not included in the interview guide were asked to stimulate further discussions on the 


topic and to provide clarifications where needed. 


All questions were asked and the same wording was used from interviewee to interviewee. 
The advantage of this research method was that the researcher was able to exercise maximum 
control over the respondent’s frame of reference when responding to questions and was able 


to pose follow-up questions to obtain more information on certain issues (Patten, 2009)’”. 


'S §. Kvale, InterViews: An Introduction to Qualitative Research Interviewing, Sage, 1996 
'° MLL. Patten, Understanding Research Methods: An Overview of the Essentials, 7" Edition, Routledge, 2009 
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However, this research method has no flexibility, requires that questions be asked with 
exactly the same wording and in the same sequence for all the respondents (Babbie and 


Mouton, 2006 )””. 


The author has arranged personal interviews with different stakeholders in Member States 
and at EU-level to obtain expert opinion covering a wide range of perspectives. Voluntary 
interviews were conducted in 2014 with 4 senior law enforcement officers in the UK, France, 
Germany, and the Baltic States. In addition, 3 individuals within the political EU structures in 


Brussels focusing on a European perspective in law enforcement were interviewed. 


The interview results were analysed and relevant aspects used in developing the arguments 
presented in this thesis. The thesis does not refer in detail to the individual answers provided 
by the respondents to guarantee anonymity of the source. Relevant statements were 


synthesised and form part of the analysis throughout the document. 


3.4 Ethical considerations 


Interviewees were in detail informed of the objectives of the study. The research strategy and 
methods of the study to the respondents were clearly explained in order to ensure that 
assumptions about the research were understood (van Thiel, 2014). *! Interviewees were also 


assured that they may withdraw from their contribution at any time. 


In the case of interviews, the participants were assured confidentiality in order to protect the 


participants’ right to privacy and guarantee their anonymity. 


There was no power relationship between the researcher and the interviewees. Interviewees 
were independent and in case where a professional existed the interviewee was higher ranked 


that the researcher. 


Although information received from participants in the interviews conducted could not be 
kept confidential as it was used to support the build-up of this thesis, no specific reference to 
any of the participants was made. Information from the interviews was only used to back up 
and confirm information gathered from other sources and to help the researcher to fine-tune 


the conceptual model of the European Criminal Intelligence Model. 


*) £. Babbie, and J. Mouton, The practice of social research, Cape Town, Oxford University Press, 2010 
*I!_ §. Van Thiel, Research Methods in Public Administration and Public Management: An Introduction. 
Routledge, 2014 
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3.5 The context of the thesis 
The main aims of this thesis are: 


(a) to review the history, development and current status of the ‘European Criminal 


Intelligence Model’ in the current EU set-up; 


(b) to elaborate its opportunities and limitations in the day-to-day policing of trans- 
national organised crime/terrorism and to highlight the resulting consequences for 


law enforcement at Member State and at EU level; 


(c) To assess the nature, level, and effectiveness of the use of intelligence between 


law enforcement agencies beyond the national level; 


(d) to examine the issues of governance and accountability in the collection and 


deployment of intelligence beyond Member State level; 


In addition, the thesis will also reflect upon the following areas, which have to be considered 


when addressing the aforementioned main aims: 


(a) to review and describe the structure of the intelligence function in Member States and 


at EU level, and the current situation regarding knowledge-based policing; 


(b) to deploy case studies of intelligence operations involving at least two Member States, 


to show reasons for their success/failure and the learnt; 


(c) to assess the general impact and contribution of ‘intelligence’ to law enforcement 
cooperation between Member States and at EU level, including a review on resources 


involved, equipment/technology, and the management of intelligence; 


(d) to identify the problems and difficulties in the collection, application and deployment 


of intelligence beyond Member State level; 


(e) make suggestions and recommendations for the further development and 
enhancement of the intelligence function in a trans-national context and at EU level, 


including areas of further research. 


Trans-national law enforcement cooperation has become a main feature in trans-national 
cooperation amongst Member States over the last decades. The EU has developed closer 
relationships that are going far beyond the initial economic cooperation. This process which 


was initially expressed in the TEU of 1982 has since been revised several times (the Treaty of 
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Amsterdam 1997, Treaty of Nice 2001, and the Lisbon Treaty 2009). What these 
amendments have in common is a development towards a more community driven approach. 


The “Hague Programme’ (2004 -2009) contained amongst others the following statements 


related to re-enforced law-enforcement cooperation beyond national level:”” 


- miulti-disciplinary and concerted action both at EU level and at national level between 


the competent law enforcement authorities, especially police, customs and border guards; 


- an innovative approach to the cross-border exchange of law-enforcement information. 


The mere fact that information crosses borders should no longer be relevant; 


- setting up and implementing a methodology for intelligence-led law enforcement at EU 


level; 


- intensified practical cooperation between police and customs authorities of Member 


States and with Europol and better use of existing instruments in this field. 


In addition, the Stockholm Programme (2010 - 2014) reiterates these statements and adds the 


following aspects: 


- to define a comprehensive Union internal security strategy based, in particular, 


on the following principles; 


- to bring clarity on the division of tasks between the Union and the Member States, 


reflecting a shared vision of today’s challenges; 


- monitoring and implementing the internal security strategy should become one of the 


priority tasks of COSI set up under Article 71 TFEU; 


- Europol should become a hub for information exchange between the law enforcement 


authorities of the Member States; 


The communication from the Commission to the Council and the European Parliament 
‘Towards enhancing access to information by law enforcement agencies (EU information 


policy)’, COM/2004/0429 final, proposed: 


- to develop EU intelligence-led law enforcement, where criminal intelligence assists the 
competent authorities in the performance of their strategic or operational tasks, in order 


to prevent and combat terrorism and other serious or organised crime, as well as the 


* OJ C 53, 3.3.2005, pp. 1-14, The Hague Programme: Strengthening Freedom, Security and Justice in the 
European Union, (2005/C 53/01) 


Page 19 of 146 


threats caused by them. The introduction of a European Criminal Intelligence Model 
would render intelligence-led law enforcement effective and allow for enhanced 
cooperative action. It would comprise issues such as the synchronisation of threat 
assessment based on a common methodology, systematic underpinning of threat 
assessment by sectoral vulnerability studies and the required financial and human 


resource allocation. 


The study is anticipated to assist in evaluating the underlying concepts, practices, procedures 
and processes focusing on criminal intelligence, by identifying possible areas of weakness 
related to a trans-national intelligence architecture, with a view to considering mandatory 


requirements to allow for successful implementation. 


As implementing such a model will also require a strong political will and direct support due 
to the direct interference with the sovereignty of the nation state in the area of justice and 
home affairs, it is believed that the content of the study will be met with interest at political 


and law enforcement level. 


During the course of the study other factors in the context of the European Criminal 
Intelligence Model were taken into account, namely the ambivalence between policing at 


national level and the political decision making at EU level. 


The meaning of the intelligence function in today’s law enforcement, starting on a national 
and focusing on a trans-national level is another aspect that will be discussed in this thesis as 
understanding the intelligence function is a key element in being able to analyse and evaluate 
the anticipated trans-national framework as proposed by the European Criminal Intelligence 


Model. 


Intelligence-Led Policing (ILP) is the (current) law enforcement answer to a changing 
policing environment. However, the concept as such is mainly Anglo-Saxon driven and there 
needs to be a reflection to which extent such a concept which builds a major corner-stone in 
the ECIM can be regarded as a valid starting point taking into account the different legal 
systems applied in Member States. In this context a critical discussion with the works 
presented by Ratcliffe (2008) are essential. Detailed academic and analytical work dedicated 
to the concept of intelligence and its impact/value at trans-national level is limited. 


The proposed research study will contribute to improve this situation. 


Trans-national exchange of intelligence goes further than the exchange of information across 


different jurisdictions. This automatically raises questions regarding accountability, the rights 
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of the individuals concerned and the need for a supervising body to guarantee that sufficient 
safeguards are in place and complied with. Another facet in this context refers to the possible 
need to develop a trans-national ‘principle of dedicated use. The thesis will explore these 


aspects in a separate chapter. 


In addition, effective law enforcement has to be put in context, as an effective law 
enforcement approach has to reflect on society it is applied in. Therefore, societal 
developments must have an immediate influence on the right law enforcement practices to be 
chosen. Developing a European law enforcement concept is even more demanding as Europe 
still is based on a nation state concept paired with an increased influence of a trans-national 
European dimension that sometimes acts as antidote. Here, the study will discuss the impact a 
societal change moving from modern to post-modern will have on the ability to implement 
the ECIM. For such an overarching concept to be successful in such a ‘hostile’ environment it 
is important to critically research if successful policing concepts like the ECIM need to be 


based on the requirements determined by the principles of a modern or postmodern society. 


3.6 Originality of the project 


Over the last 20 years the concept of intelligence, often also referred to as ‘Intelligence-Led 
Policing’ (ILP) as an effective tool in the tool-box of law enforcement policing has received 
quite some attention and has been subject to many initiatives to establish a more streamlined 
trans-national or even European approach. However, being en-vogue for such a long time has 
also led to further developments in this area. ILP which has been the driving force for many 
policing models at national and international level is nowadays at least contemplated by other 
concepts like problem-oriented or knowledge-based policing. Still, ILP can still be found in 
many major initiatives (e.g. Project Harmony initiated by the Belgian Presidency in the 


second half of 2010).”° 


The thesis aims at providing a contribution to the body of knowledge in this field, by giving 
an insight into how the law enforcement community conceives the concept of intelligence, 


especially in a European context and the problems involved. 


°° Council of the European Union, ‘Result of the “Harmony” project — “A generic European Criminal 
Intelligence Model — Bringing together the existing instruments and strengthening Europol’s central role’, 
Enfopol 282, http://register.consilium.europa.eu/pdf/en/10/st14/st14851.en10.pdf, viewed on 20 May 2015 
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Another focus was put on human rights issues related to the trans-national exchange of 


intelligence in the framework of an ECIM, taking into account that such a framework might 


actually considerably collide with the basic principles related to a common space of Justice, 


Freedom and Security in Europe. The work also considered, although to a lesser extent the 


impact resulting from the entering into force of the Lisbon Treaty because there is still too 


little practical experience yet concerning the impact of the treaty in the area of law 


enforcement cooperation. 


Specifically, the thesis derives its originality from the fact that 


it is the first time a possible European Criminal Intelligence Model is being looked at 
from an academic and analytical perspective. There is an enormous amount of 
documentation addressing the concept of an ECIM but this documentation is more 
concerned with the practicalities rather than examining the scientific basis for proposing 
such an approach. This is different in the thesis. The work goes beyond the ‘status quo’ 
and develops a critical perspective when assessing the possible success for implementing 


the ECIM; 


the scope and perspectives of the already existing documentation related to an ECIM 
often lacks an academic level, with concepts, theories and a proper research 


methodology; 


there is no holistic view on the ECIM, its consequences for policing at national level, 
and the impact related to human rights aspects. This thesis tries to provide such an 


overarching perspective; 


finally, the thesis is a product combining the strength of a scientific approach with the 
experience and knowledge of almost 30 years of policing, therefore striking the balance 
between the need for a proper theoretical foundation and a practical framework in which 


such a theory can be successfully applied. 
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3.7. Rationale for and sequence of chapters 


The author of this thesis has been in law enforcement for more than 30 years in a variety of 
different functions and positions at national and international level. During his time at 
Europol (1998-2012) the author has been actively involved in the developing the OCTA 
methodology and the ECIM in close cooperation with representatives in Member States. The 
extensive work done enables the author to draw from his own experience, to have access to a 
variety of experts, and to be aware of relevant documents and developments that impacted 
and still impact the successful implementation of the ECIM. The professional experience is 


also reflected in the structure of the chapter 


The thesis starts with an Abstract, followed by an Introduction outlining the pathway on 
which the project developed and the direction the project will take. The introduction includes 
the problem statement, the purpose of the study, its significance and justification, scope and 


limitations, and the methodology chosen. 


The third chapter described the chosen methodological approach taken in writing this thesis. 
The chapter addresses questions related to qualitative and quantitative research aspects 
applied for writing his paper. In addition, possible ethical considerations are reflected upon, 
as well as the time-frame and the continued update of the thesis for the findings to stay up-to- 


date. 


The fourth chapter ‘Literature Review’ summarises available evidence on the concept and 
development of a trans-national intelligence community with a specific focus on the 
differences/similarities amongst some Member States and at EU level in relation to the 
ECIM, including generic reflections for a law enforcement based ‘intelligence model’. 

The review also focuses on the societal developments in Europe with a specific emphasis on 
modern and post-modern concepts as an influencing factor for the implementation of the 


ECIM in a societal context. 


The fifth chapter addresses the basic question regarding the differences between Intelligence 
and Information as the basic ingredient for an ECIM. Elaborating on the potential differences 
between the concepts is important for understanding the data requirements for the ECIM. 
Information is referring to a factual framework whereas intelligence always contains an 
interpretative component. Relying on intelligence when developing a strategic tool for 


priority setting calls for a different data-model compared to a model based on information. 
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Chapter six discusses the theoretical framework of the ECM, especially if the model is a 
Criminal-Intelligence Model or a Criminal Intelligence-Model as the place for the hyphen 
creates a fundamental difference with regard to how such a model will look like. Referring 
only to Criminal-Intelligence in the model narrows the perspective whereas a crime focused 
Intelligence-Model to tackle organised crime takes a wider holistic perspective in deciding 


upon strategic priorities. 


Chapter seven provides an overview beyond the national level identifying the non-criminal 
environment in which trans-national organised crime activities are embedded in. Any ECIM 
has to take into account the trans-national landscape to be able to deliver strategic findings 
that are suited to accommodate differences that exist when European findings have to be 
translated into regional and national settings. In addition, the role of the private sector as an 


important contributor to the ECIM is highlighted. 


In chapter eight the reader is provided with a reflection on the challenges traditional law 
enforcement faces when a criminal investigation at tactical level is used as source for 
strategic analysis. In contrast to the strategic analysis proposed for the ECIM data obtained 
for a criminal investigation is fact based and does not interpret. The chapter also reviews 
existing assumptions related to organised crime, especially the business-like concept and the 
rational-actor hypothesis. The latter being of specific interest when putting the ECIM in a 
modern or postmodern context. Finally the chapter elaborates on the necessary link between 


the ECIM and National Intelligence Models. 


As the (Serious and) Organised Crime Threat Assessment ((S)OCTA) is the core component 
of the ECIM chapter nine describes the OCTA concept and the way the OCTA is anchored 


within a national context. 


Chapter ten describes in more detail the modern/postmodern link the ECIM has to consider 
for being successful. It is the reflection on the current societal set-up which also influences 
the way law enforcement agency act at national and trans-national level. In consequence the 


ECIM has to follow a different path when operationalising strategic findings. 


Chapter eleven focuses on data protection and the human rights dimension taking into the fact 
that standardised trans-national exchange of intelligence will change the role of the individual 
who might have to bear personal consequences resulting from such an exchange. 

This includes the question of accountability where intelligence exchanged in the framework 


of an ECIM is used in another Member State to initiate coercive measures. 
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Chapter nine puts the ECIM and the (S)OCTA into a structural framework, elaborating in 
detail on the threat assessment component, as the potential success for implementing an 
ECIM to be recognised by law enforcement in Member States depends on a common 
understand on how the ECIM produces its strategic findings that have to be operationalised at 
national level. Accepting the structural frame is a prerequisite to embrace the related data 


collection requirements. 


The conclusion is a summary of the work delivered, focusing on the highlights elaborated and 
making recommendations on enhancing and properly embedding the exchange of intelligence 
in a European Criminal Intelligence Model including law enforcement requirements in a 


changing society, and will include areas for further research. 


3.8  Time-frame of sources used 


Relevant information and sources used for this thesis range are from the mid-90s to 2015 and 
the information and researched data is up to date with regard to the date of the thesis 
submission and its revision. The author continues to monitor and research trends in the thesis 


topic. 


3.9 Research design 


The research design followed for writing this thesis is summarised in the following chart: 


The Applied Research Design 
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4. Literature Review 


This chapter summarises available evidence on the concept and development of a trans- 
national intelligence community with a specific focus on the differences/similarities amongst 
some Member States and at EU level in relation to the ECIM, including generic reflections 
for a law enforcement based ‘intelligence model’. The review also focuses on the societal 
developments in Europe with a specific emphasis on modern and post-modern concepts as an 
influencing factor for the implementation of the ECIM in a societal context. Finally, the 
literature review provides the overall context for the ECIM by describing the history of the 


developments at European level. 


4.1 Literature related to the concept of a European 


Criminal Intelligence Model 


Literature focusing on the European Criminal Intelligence Model is scarce. Although the 
long-term consequences of introducing the ECIM will fundamentally re-shape law 
enforcement priority setting in the EU the approach has not been met with a significant 
response from academia. The best know discussion on the subject is an article by Hugo Brady 
(2008). The article recognises organised crime as a rising threat for the Member States of 
the EU. Brady takes note of an increased Europeanization, the beginning of which he dates 
back to 2004. Although Member States accept the need for a closer-cross border and trans- 
national cooperation, law enforcement agencies still have difficulties to accept the transfer of 
their ‘responsibilities’ to a trans-national, European level. Brady highlights the diversity of 
the different law enforcement agencies in Member States as another reason that makes it 


difficult to harmonise law enforcement activities beyond a national perspective. 


Although not outspoken in this context Brady addresses the basic difficulties when the needs 
of a post-modern society are dealt with from a modern perspective. Not the fact that 

law enforcement functions differently in different Member States is new, what is new is the 
acknowledgement that such differences will make it difficult to be streamlined by monolithic 


approaches. Although this is not directly referring to a post-modern concept, accepting 


* H. Brady, ‘Europol and the European Criminal Intelligence Model: A Non-state Response to Organised 
Crime’, Oxford Journal ‘Policing’, 2008 
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‘law enforcement pluralism’ at country level as a possible obstruction to achieve a solid, 
harmonised European standpoint bears some similarity to questioning the validity of the 


‘grand narrative’ in a post-modern society. 


With regard to trans-national investigations and prosecutions Brady refers to the Council of 
Europe Convention on Mutual Assistance in Criminal Matter as the only instrument that 
would enable such activities. Taking into account that Brady’s article dates back to 2008 

it is not surprising that there is no mentioning of the Priim Treaty or the European Criminal 
Records Information System (ECRIS). It is interesting that Brady did not mention Council 
Framework Decision 2006/960/JHA of 18 December 2006 which focuses on simplifying the 
exchange of information and intelligence between law enforcement authorities of Member 
States of the European Union. Especially with regard to a proposed European Criminal 
Intelligence Model it would have been worthwhile to mention the decision as an instrument 
providing the legal basis for the trans-national exchange of information and intelligence 


generated in a law-enforcement environment. 


The article outlines the principles of law enforcement cooperation, putting a focus on national 
perspectives highlighting the tendency to implement structures that support national 
investigations which have a trans-national dimension, e.g. by using the Schengen Information 
System or via the Schengen Agreement. Regarding trans-national cooperation and 
coordination mechanisms Brady highlights the Police Chief Task Force and the 
‘Comprehensive Operational Strategic Planning for the Police’ (COSPOL). With regard to 
COSPOL it needs to be understood that this mechanism was intended to prioritise competing 
trans-national investigations without a decision making mechanism based on a pan-European 
perspective, therefore not really a tool to be used for a ECIM.” When addressing the 
European perspective Brady highlights the role of COREPER (Comité des représentants 
permanents) and CATS (Comité de l'article trente-six). Although both entities fulfil a certain 
function within the new European internal security structure the entering into force of the 
Lisbon Treaty has changed their actual roles - a process which until now is still going on and 


is further influenced by defining the role of COSI.”° 


* It should be noted that the framework for the activities of the EPCTF have changed and the COSPOL 
mechanism does not exist anymore. 

°° The future of CATS - Contribution to the evaluation by COREPER, CATS 179 (2014) 
http://data.consilium.europa.eu/doc/document/ST-15508-2014-INIT/en/pdf, viewed on 24 July 2015 
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Brady describes Europol as the ‘main tool to assist Member States in their investigations into 
transnational organised crime’ and regards the introduction of the ECIM as a ‘subtle attempt 


to promote the use of intelligence-led policing methods throughout the EU’. 


As further elaborated in this thesis Brady also recognises the missing acceptance of the ECIM 
by law enforcement agencies in Member States. However, he believes that the acceptance 
level will increase over time, once law enforcement agencies have gotten used to its 
existence. It seems that Brady does not entirely reflect on the fundamental paradigm change 
an ECIM will bring, taking away a large piece of national sovereignty in deciding on law 
enforcement investigative priorities. Brady confirms the different perspectives of Member 
States in relation to the ECIM by referring to the different contributions received by Europol 
with regard to the same objective (‘one Member State contributed 500 pages of criminal 
intelligence to Europol’s first organised crime threat assessment, another offered only a 
single page’). He identifies the fundamental problem of enhanced trans-national police 
cooperation as being based on the different roles prosecutors and police have across the EU. 
The solution offered is the creation of a single European law enforcement coordination body 
consisting of at least Europol and Eurojust to demonstrate uniformity across the EU. 

This solution does not take into account that such a construct only works if there was also a 
European Criminal Code and a European Code of Criminal Procedures, otherwise trans- 
national criminal investigations have to be dealt with in national courts applying the national 
judicial framework. Both are instruments which would require an even greater transfer of 
national sovereignty to the EU-level. A paradigm shift which at the moment is still more 
difficult to imagine becoming a reality than a functioning ECIM. In his final conclusion 
Brady pledges for a de-centralised ECIM based on a mixture of formal and informal channels 
as the best set-up to make the ECIM a success. This illustrates that Brady regards the ECIM 
as a next step in the evolution towards closer law enforcement cooperation, including the 
European level. He does not consider the ECIM as a new model replacing the existing 
framework by shifting strategic responsibilities to the European level, taking a holistic 
perspective on organised crime independent from national priorities. The ECIM approach 
outlined by Brady is different to the ECIM concept referred to in this thesis, therefore only of 
limited use in the context of the following discussions. However, emphasising the need to 
accommodate regional differences reflects the requirements resulting from an ECIM 


deployed in a post-modern society. 
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Reiner (1992) discusses the reasons for the change of the image and substance of policing in 
the United Kingdom.”’ In his article he refers to general social developments as the main 
driving force for this change. As later outlined in this thesis Reiner also sees the police 
function as a direct result of the Weber’s state concept (pp. 761-762) where only the police is 
empowered to exercise legitimate force, making the police a fundamental cornerstone for the 
functioning of a state. Reiner believes that the change towards the police started in the 70ies 
when several corruption scandals involving Scotland Yard were unveiled to the public 

(p. 764) and continued into the late 80ies and early 90ies. However, not only the societal 
perspective towards the police changed, there was also a change of focus within the police. 
Reiner describes this change as shifting the public order focus from industrial or political 
conflicts to entirely new areas like curbing joy-riding, targeting acid house parties or taking 
action in the context of hippy convoys converging on Stonehenge. Although Reiner describes 
this as a shift by the police it might be more accurate to regard this as a manifestation of the 
gradual development of a post-modern society where the police, still caught in the Weberian 
context, was reacting according to the modernist paradigm. The actual face of policing 
changed from the original concept of preventive patrol by uniformed police officers as the 


basic function of policing to more specialised and plain clothes units in the 80ies. 


Reiner explains this change as the ‘consequence of an apparent crisis of police effectiveness 
in controlling crime’, another indication that a fundamental transformation with regard to the 
relationship between the police and the citizen was taking place. Although Reiner continues 
to focus on the actual national perspective of policing in the United Kingdom there is an 
interesting observation related to the local compared to a more centralised perspective when 
he states that ‘the perceived lack of adequate local accountability has been a major factor 
undermining police legitimacy in recent years’ (p. 769). Translating the quote in light of this 
thesis it seems that there is a constant ‘clash’ between policing at local level, which would 
refer to national policing and a more centralised policing model, which would refer to the 
international dimension like the ECIM with the ECIM not taking into account the specific 
needs at national level (local accountability). If such competing interests are already observed 
within the national context it is no surprise that introducing similar mechanisms at trans- 


national level might encounter even stronger resistance, as outlined in more detail later on. 


ZI Re: Reiner, ‘Policing a Postmodern Society’, The Modern Law Review, vol. 55, no. 6, pp. 761-781, 1992 
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Reiner identifies changes in society that represent a major shift with regard to established 
behavioural patterns. Society has moved away from being a homogeneous structure, simply 
accepting state authority towards a multi-facetted society characterized by the notion of 
‘desubordination’, also questioning the traditional authority of law enforcement. 

Accepting the fact that former monolithic structures as described by Weber are replaced by 
heterogeneous ones points again towards an area which at least is different from a pure 
modernist perspective. Reiner uses C. Wright Mills public lecture at the London School of 
Economics in 1969 to support his argument.”* As a consequence Reiner proposes that in a 
post-modern society “grand narratives’ cannot fulfil the role they had been given in a modern 
context, individual solutions are replacing these narratives with the premise that ‘all that 
counts is what works for particular protagonists in specific contexts’ and the Weberian state 
concept is replaced by a ‘multiciplicity of sites of social reproduction’. For the remainder of 
the text Reiner addresses the question on how the police in the United Kingdom can regain 
‘old grounds’ by adopting new strategies taking into account the challenges posed by a 
postmodern society. As these aspects are not relevant for the research questions of this thesis 
due to the focus on a trans-national dimension a further reflection on Reiner’s perspective has 


been omitted. 


Christopher Murphy (1998) also focuses on a national perspective.” He discusses how the 
Canadian police best can react to the changes resulting from the development of a society 
which is moving from modern to post-modern. The article provides a descriptive analysis and 
overview of current shifts of policing in Canada and suggests that these changes indicate the 
declining significance of modern policing concepts and strategies and the emergence of a 
post-modern model of policing in Canada. Murphy cross-references to Reiner’s and refers to 
Sheptycki’s work in relation to postmodern aspects of policing. Certain aspects highlighted in 
the article help to critically reflect on the achievability of the aims and objectives of the 
ECIM in a trans-national context. Murphy supports the view that ‘that the modern policing 
model no longer provides an adequate explanatory frame of reference and that contemporary 


changes indicate a new but still developing "postmodern" model of policing’. 


°8 Mills' characterisation of this ‘post-modern period' captures the gist of what contemporary analysts mean: 


“Our basic definitions of society and ourselves are being overtaken by new realities”. This is not, argues 
Mills, merely because of the pace of change and the struggle to grasp the meaning of it. Fundamentally, 
Mills claims, the explanatory and ethical frameworks which we inherited from the Enlightenment and which 
have dominated the 'modern' age, primarily liberalism and socialism, “have virtually collapsed as adequate 
explanations of the world and of ourselves”. 

C. Murphy, ‘Policing Postmodern Canada’, Canadian Journal of Law and Society, vol. 13, no. 2, October 
1998, pp. 1-25 
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Murphy attributes the need for a change in policing to the declining power of the nation state. 
In addition to Reiner, Murphy reflects on trans-national aspects of policing which he 
describes as ‘a form of state policing concerned with protecting the integrity and security of 
the nation state by establishing relationships with the policing and security institutions of 
other nations’ as a consequence of countries realizing that the threat posed by trans-national 
crime can only be addressed within a trans-national context. However, Murphy does not see 
this trans-national cooperation as a logical step in trying to develop an effective counter 
strategy against organised crime, he regards trans-national cooperation as an act by central 
governments to diminish or off-load some of their domestic policing responsibilities. 

From a policing perspective Murphy regards this development as providing unique 
organisational advantages due to the fact that such cooperation is ‘almost invisible and (...) 
therefore largely unaccountable and uncontestable’ . Taking into account the developments at 
European level over the last years it should be noted that this perception is meanwhile 


refuted. 


Although accountability of trans-national cooperation is sometimes challenged, especially by 
the European Parliament there is no doubt that trans-national law enforcement cooperation is 
complying with the requirement of accountability and that accountability continues to be a 
major concern for the law enforcement community itself. Too great is the fear that criminal 
investigations, still only followed-up within a national judicial framework are ‘spoiled’ due to 
the use of information or evidence from other jurisdictions which do not comply with 
mandatory national standards. Murphy develops an interesting aspect of postmodern national 
policing. Even now, 17 years later this aspect provides a valuable perspective for trans- 
national policing, especially with regard to the ECIM and the link between operational and 
strategic goals in policing. Murphy argues that with regard to the role of the Royal Canadian 
Mounted Police (RCMP) as the centralised law enforcement agency in Canada ‘the decline of 
centralized federalism and the growth of provincial powers ironically may mean that the 
RCMP's national policing function will be one of the few remaining national, federal 
institutions in a decentralized Canada, making the federal policing mandate even more 
important. ... While the modern view of national policing and security in Canada was 
embodied in a centrally controlled, directed and colonial RCMP, the postmodern national 
RCMP of the future may be smaller in size but will retain national influence through its 
exclusive role as the center and source of expensive, highly specialized police services’ . 


Transferring this perspective into the trans-national concept of the ECIM it can be argued that 
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the role of the ECIM might well be defined by providing strategic guidance for law 
enforcement agencies in Member States where the transformation of these strategic findings 
remains at Member States level. The description of the future Canadian policing model 
Murphy provides in his conclusions can be looked at as a possible trans-national policing 
model, including the ECIM and what the ECIM would be able to achieve in a post-modern 
law enforcement set-up. How current Murphy’s thoughts are is finally underlined by the set 
of questions he formulates at the end of his article. The majority of these questions still are 


waiting for a conclusive answer in 2015.°° 


4.2 Explaining Postmodernity as an influencing factor for 


implementing the ECIM 


Being able to reflect on the possible success for implementing the ECIM requires an 
understanding of societal developments as the societal framework defines how an ECIM is 
received by the parties involved. Since Enlightenment modernity has been an agreed concept 
for Europe. For quite some time this basic concept has been challenged by a postmodern 
approach. If modernity as the foundation of our society is challenged the consequences of 
such a challenge for implementing the ECIM need to be understood. These consequences will 
influence how the ECIM can be successfully implemented. The roots of post-modernism are 
linked to areas of architecture and literature. The main characteristic being that there is no 
universally agreed concept. Postmodernity is multi-facetted and cannot be reduced to a single 
one-dimensional perspective. Francois Lyotard is widely regarded as the originator for 


defining postmodernism. 


Lyotard (1979, p. XXIV) defines postmodernism as ‘incredulity towards meta-narratives’ 
where meta- or grand-narratives are ‘large-scale theories and philosophies of the world, such 


as the progress of history, the ability to know and explain everything by science, and the 


There are other publications that cover certain aspects related to the link between law enforcement and the 
postmodern society, the most notable being the ‘Policing, Postmodernism and Transnationalization’ by 
James Sheptycki, published in the British Journal of Criminology, Volume 38, Issue 3, page: 485-503, 1998; 
and “Transnational Policing and the Makings of a Postmodern State’ by James Sheptycki, published in the 
British Journal of Criminology, Volume 34, Issue 4, pages 613-635, 1995. Both articles have been written 
during the 90ies when the postmodern discussion for law enforcement was at a height. It is obvious that at 
the date of publication the ECIM was still far from being postulated and even Europol, as the actual enabler 
of the ECIM as outlined in this thesis was still in an embryonic phase of development, as the entering into 
force of Europol only took place on | July 1999. Therefore, the immediate impact of these articles to this 
thesis is limited. However, with regard to the postmodern aspects addressed as an important factor to 
evaluate an overall policing concept are relevant. In addition, all articles referred to allow for a retrospective 
evaluation of the predicted developments. 
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possibility of absolute freedom’ .*'! Meta-narratives are conceptual constructs used to provide 


a comprehensive explanation on what happens in society and why these things happen. 

A meta-narrative describes the mechanisms in society by a single consistent story from start 
to finish, thereby providing coherent meaning. Once meta-narratives are accepted by society, 
a self-propelled process starts to support and justify the validity of the narrative as the overall 
paradigm having sole explanatory power. In a longer process these meta-narratives and the 
respective symbols representing the conceptual framework for the narrative are reinterpreted 


and repeatedly codified resulting in a continued reinforcement of the meta-narrative itself. 


Best known examples of such meta-narratives and the above described societal mechanisms 
linked to it are religion, Marxism, nationalism, and science. All these conceptual frameworks 
are authoritative and offer a full set of answers of how the world works. In addition, they 
provide a predetermined worldview based on an absolute and unquestioned set of values. 
Lyotard challenges the validity of such meta-narratives. According to him these singular 
explanations of human knowledge started losing their power to convince people of their 
truth-value by the second half of the 20th century. This point in time is closely linked to the 
emergence of mass media and a rise in education standards. The main idea in postmodernity 
is that there are multiplicities of truths instead of one all-encompassing truth which makes it 
difficult to decide which truth to rely upon. Lyotard refers to these multiplicities of truths as 
‘petit recits’ (1979, p. 60). Petit recits have limited validity in place and time, are evolving, 
progressive, and adaptable with the ability to move in different directions, allowing for 


diverse interpretations in co-existence. 


Before Lyotard it was Nietzsche who provided a first account of a postmodern perspective. 
In 1873 he questioned the relationship between language and truth. Regarding ‘truth’ he 
wrote that ‘/truth is] a sum of human relations which became poetically and rhetorically 
intensified, metamorphosed, adorned, and after long usage seem to a nation fixed, canonic 
and binding: truths are illusions of which one has forgotten they are illusions; worn-out 
metaphors which have become powerless to affect the senses; coins with their images effaced 
and now no longer of account as coins but merely as metal.’**. Nietzsche replaces ‘absolute 
truth’ by truth as a human construct, metaphors without true reflection of actual content, a 


perspective which corresponds to the postmodern concept addressed by Lyotard. 


*!_B. Lyotard, The Postmodern Condition: A Report on Knowledge, University of Minnesota Press, 1979 
*° B. Nietzsche, On Truth and Lies in a Nonmoral Sense, CreateSpace Independent Publishing Platform, 2015 


Page 33 of 146 


The concept of postmodernity is present in many areas within today’s society, especially the 
Internet as the most prominent source of information currently available. The Internet is an 
amorphous entity, consisting of the input from an almost countless number of individual 
sources, providing fragmented pieces of information to create a constantly evolving and ever- 
changing truth without a definite right or wrong. In addition, political disparity, sexual 
liberation, the clash of cultures and even the concept of drug use could be argued to be the 


result of a postmodern development, lacking universally agreed or absolute values. 


With modernity communication moved from oral to written, emphasising that only the 
written word is reliable; concepts moved from particular to universal and from local to 
general. Only what was regarded to be universally was seen as true. In addition, concepts 
were timeless, not depending on context - what is proven as objective truth remains 
unchanged. Postmodernity started to challenge this system, reverting back to the usefulness 
of oral communication, particular circumstances, local peculiarities, and the importance of 


time as the fundamental ingredients of a contextualised reality. 


Postmodernity is linked to the concept of deconstruction. Deconstruction describes the 
process of taking constructs apart, usually without putting them back together. 
Deconstruction can be seen as the most powerful tool in a postmodern set-up, although often 
deconstruction is regarded as merely destructive by only dissembling existing constructs 
without offering an option to reconstruct them again. Even in a postmodern setting the ECIM 
has to reconstruct organised crime as a follow-up process. However, this reconstruction based 
on available information/intelligence from a variety of different sources has to be done under 


a postmodern perspective. 
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43 An overview regarding the history of law enforcement cooperation in 


the EU 


Alongside the transition of the European Economic Community towards a more consolidated 
European Union developed a closer cooperation in trans-national policing and security 
cooperation. This development was fuelled by the fact that moving towards a European 
Union without internal borders facilitated trans-national cross-border crime, which resulted in 
a mounting pressure for increased international cooperation for fighting and preventing crime 
within Europe.” Even if there has been the intention to move towards greater 
‘Europeanisation’, the core of trans-national law enforcement cooperation remained being 
defined by the national set-up in Member States based on national sovereignty. As different 
as individual Member States function, so do national agencies involved in law enforcement. 
This is even more complicated where Member States have developed more decentralised 
systems, creating additional and sometimes even competing structures at national, regional or 
local level. To be able to create a common approach in trans-national law enforcement 
cooperation it is imperative to consider these differences. Such cooperation is based on an 
extensive exchange of information and intelligence containing personal data. This exchange 
could result in unprecedented problems related to accountability for the use of such data, 


especially in the area of data protection. 


Data, exchanged cross borders are further processed and analysed in a different judicial 
context. Due to different legislation the processing of the data could lead to coercive 
measures which would not have been possible under any other circumstances. This entails the 
unwanted risk of the violation of fundamental human rights, if the respective legal framework 
for the trans-national exchange and use of such data does not exist. In the context of law 
enforcement related trans-national data-exchange criticism is raised regarding the missing 
democratic participation in the respective decision making processes applied in this specific 


area of cooperation. 


> The European project to create a single market, in which its citizens can move themselves, their money, 


goods and services freely around the Union, has dramatically altered the pattern of cross-border crime in 
Europe. By lifting internal barriers—at least between the full Schengen members, which do not include 
Britain and Ireland, nor, though it has at least signed the convention, Greece - the EU’s members have 
pushed their border controls to the outer rim of the Union. By, in turn, tightening up that periphery, they 
have driven certain cross-border activities underground, sometimes sending even genuine refugees into the 
hands of criminals, who now traffic them for profit alongside illegal migrants. And, by creating a single 
internal market, Europe has also created for itself a new single market in crime. Source: The Economist, 14th 
October 1999, http://www.economist.com/node/248575, viewed on 3 January 2012 
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Another aspect related to improved horizontal trans-national law enforcement cooperation 
refers to a lack of judicial control, especially if such activities fall under the responsibility of 
the European Union (Europol) rather than law enforcement agencies in individual Member 


State. 


However, the concern of Member States over the possible loss of sovereignty especially in 
the area of law enforcement, criminal justice, and internal security acts as natural 
counterweight. Although there have been major changes in trans-national law enforcement 
cooperation and a much stronger involvement of the European legislator developments in the 
area of trans-national law enforcement/judicial cooperation have been fragmented rather than 
comprehensive. Organisations, structures, and procedures for increased law enforcement 
cooperation in the European Union have rather evolved on an ad-hoc basis in order to cope 
with new emerging trends or have been limited due to the continued reluctance of Member 


States to engage in more systematic and far-reaching levels of cooperation. 


The following chapter provides an account of the most important developments in the field of 
increased trans-national law enforcement cooperation within the European Union. During the 
70ies and into the late 80ies many European Member States were suffering from acts of 
terrorism perpetrated by both European and non-European groups.” Until this moment in 
time Interpol was the only existing international mechanism to coordinate cross-border law 
enforcement activities. However, Article 3 of the Interpol Constitution stipulates that ‘it is 
strictly forbidden for the Organisation to undertake any intervention on activities of a 
political, military, religious or racial character’. This limitation resulted in Interpol being a 
rather ineffective tool for Member States to deal with international terrorism. It also created 
an obstacle for Member States to cooperate via Interpol in these areas as there was no proper 
control mechanism in place safeguarding information against unwanted dissemination. 

As a consequence Member States decided to opt for an enhanced law enforcement 
cooperation limited to the European context. In December 1975 the Council of Ministers 
established one of the earliest forms of international police cooperation in the European 


Union - TREVI.* 


* £.g. PIRA (UK), RAF (DE), Action Direct (FR), CCC (BE), Brigade Rosse (IT), ETA (ES), GRAPO (ES), 
17th of November (GR), FARL, PFLP, Carlos, Abu Nidal 

3 Key texts on justice and home affairs, Vol. 1 (1976-1993), ‘From TREVI to Maastricht’, Statewatch 
Publication 1997, http://www.statewatch.org/semdoc/assets/files/keytexts/ktintro.pdf, viewed on 4 January 
2012 
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The origin of the term TREVI is not entirely clear but it is widely regarded as an acronym for 
‘Terrorism, Radicalism, Extremism and Violence’ .*° Although seen as the right move to 
improve trans-national law enforcement cooperation TREVI has been criticised for not being 
subject to an independent control mechanism and for being entirely disconnected from other 


European Union structures. 


In 1992 the Maastricht Treaty gave a new impetus regarding the further development of 
European law enforcement cooperation by establishing the so-called ‘Third Pillar’ related to 
‘cooperation in the field of Justice and Home Affairs.*’ Article K of the Maastricht Treaty 
mentioned customs and police co-operation as “matters of common interest... [F]or the 
purpose of achieving the objectives of the Union’. Although the wording was vague the 
Maastricht Treaty is an important milestone in realising that trans-national crime within the 
European Union should not only be dealt with at national but also at trans-national level. 
By creating the Third Pillar a first step was taken to start transferring law enforcement 
competencies that were of common interest among Member States to the European Union 
level.** However, the concept of the Third Pillar entailed that the final responsibility for 
activities within the Third Pillar remained under the supremacy of Member States.*” 

The Council was only able to consider action if at least one Member State had taken an 


initiative in the respective area. 


With the signature of the Schengen-Agreement on 14 June 1985, the next level of law 
enforcement cooperation was established, taking into account the need to overcome existing 
obstacles in trans-national law enforcement cooperation as a result of implementation of the 
principle of free movement of goods and persons in the European Union which led to the 
abolishment of internal EU border controls. To balance out the negative impact for law 
enforcement, still limited to national jurisdiction the agreement also promoted a higher level 
of law enforcement cooperation among Member States with a specific focus on the exchange 


of information, operational cross-border cooperation, and controlled deliveries. 


°° TT. Bunyan (ed.), ‘TREVI, Europol and the European state’, Statewatching the new Europe, Statewatch, 


1993, p. 1 

Aricle K, supra note 1, Maastricht Treaty 

These common areas of interests were: (1) asylum policy; (2) rules governing the crossing by person of the 
external borders of the Member States and the exercise of controls thereon; (3) immigration policy and 
policy regarding nationals of third countries; (4) combating drug addiction; (5) combating fraud on an 
international scale; (6) judicial cooperation in civil matters; (7) judicial cooperation in criminal matters; (8) 
customs cooperation; (9) police cooperation. 

The Maastricht Treaty (Art. K.1 and K.3) only provides that Member States shall regard the identified areas 
as matters of common interest, shall consult one another within the Council with a view toward coordinating 
their action, and shall collaborate among the relevant administrative departments. 
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Regarding information exchange Art. 39 of the Schengen-Agreement was an important 
development as Art. 39 requested from law enforcement agencies in Schengen States to 
render mutual assistance in providing information upon request to other law enforcement 
agencies in another Member State for the prevention or detection of criminal offences. In 
addition, Art. 46 introduced the concept of free exchange of information which may help to 


prevent future crimes or threats to public order. 


The Europol Drugs Unit, the forerunner of Europol, was established in January 1994. 
Based on a German proposal Europol was envisaged to serve as a centre for information 
exchange and knowledge and eventually to be empowered to have executive powers which 
would allow Europol to operate within Member States. Europol was recognised in the 


Maastricht Treaty under the new title of Justice and Home Affairs. 


4.3.1 Europeanization 


The process of European integration started after the Second World War with the 
reconstruction of the Western European infrastructure focusing on rebuilding economic 
strength. In 1951 the Treaty of Paris which established the European Coal and Steel 
Community (ECSC) was signed by Belgium, the Netherlands, Luxemburg, France, 

the Federal Republic of Germany and Italy. The treaty was valid for 50 years, ending in 2002. 
The ECSC aimed at regulating the markets for rebuilding European resources (coal, steel and 
iron) and is regarded as the starting point for the economic integration process of Western 
Europe. In 1952 Belgium, the Netherlands, Luxemburg, the Federal Republic of Germany, 
France and Italy signed the European Defence Community (EDC) and the European Political 
Community (EPC). Again, the EDC was to be in force for 50 years. The EDC was driven by 
the idea to create a common European army, composed of soldiers stemming from particular 
countries and to set-up a common headquarters for a European army. However, in 1954 the 
French National Assembly rejected the EDC and as a consequence the ideas expressed in the 
EDC and EPC were not followed up further, narrowing European integration mainly to the 


area of economic cooperation. 


Nevertheless, the integration process continued an in 1958 the treaties establishing the 
European Economic Community (EEC) and the European Atomic Energy Community 
(Euratom) were signed in Rome. This time, in contrast to the ECSC, to be in force for an 
indefinite period of time. The Treaties of Rome led to a partial removal of restrictions 


separating individual markets and economies in the participating countries. The EEC Treaty 
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also introduced the four freedoms of the common market: the free movement of persons, 
services, foods and capital. In 1987 the Single European Act (SEA) modified the Treaties of 
Rome. The SEA transformed the decision-making process in the Communities, laid the 
foundations for a common European market, which led to the European Union’s Internal 
Market within the Community by 1 January 1993 and enhanced co-operation between the 
Member States of the European Communities. In 1993 the Treaty of Maastricht on European 
Union (TEU) entered into force. The TEU introduced changes to treaties establishing the 
European Communities, e.g. by substituting the European Economic Community by the 
European Community. In addition, the TEU defined new areas of co-operation among 
Member States, especially in the area of Common Foreign and Security Policy (Second 
Pillar) and related to Justice and Home Affairs (Third Pillar). According to the TEU the 
following objectives were set for the European Union, which did not yet have a legal status: 
(a) to promote economic and social progress ... through the creation of an area without 
internal frontiers, ... and through the establishment of economic and monetary union, 
ultimately including a single currency; (b) to assert its identity on the international scene, in 
particular through the implementation of a common foreign and security policy ..., which 
might lead to a common defence; (c) to strengthen the protection of the rights and interests of 
the nationals of its Member States through the introduction of a citizenship of the Union; (d) 
to maintain and develop the Union as an area of freedom, security and justice, in which the 
free movement of persons is assured in conjunction with appropriate measures with respect to 
external border controls, asylum, immigration and the prevention and combating of crime; 
and (e) to maintain in full the acquis communautaire and build on it ... with the aim of 


ensuring the effectiveness of the mechanisms and the institutions of the Community. 


In 1999 the Treaty of Amsterdam (TA) followed. One of the most important changes 
introduced by the Treaty of Amsterdam focused on the Second and Third Pillars of the EU. 
The Common Foreign and Security Policy got linked closer to the European Union and 
became a common area for all Member States. Activities in this area now were based on 
supranational cooperation rather than a lighter scale of coordination as it was in the past. 
Regarding the Third Pillar (Justice and Home Affairs), the Treaty of Amsterdam introduced a 
division of the pillar into areas which were transferred to the First Pillar (policies concerning 
visas, asylum, immigration and other regulations related to the free movement of persons), 
and other areas that exclusively were left within the Third Pillar. These areas remained to be 


based on the principle of intergovernmental cooperation. As a result of this separation the 
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Third Pillar also became known as ‘Policy and Judicial Co-operation in Criminal Matters’. 
The Treaty of Amsterdam also put an emphasis on enhanced cooperation of the Member 
States and introduced the possibility of invoking sanctions against Member States that would 
violate existing laws and rules that were binding in the Community. The powers of the 
European Parliament were strengthened, enabling the Parliament to object legislative 


proposals put forward by the European Commission. 


The TA was succeeded by the Treaty of Nice in 2003 as a result of the rejected Constitutional 
Treaty, focusing on necessary amendments as a result of the enlargement of the EU by 12 


new Member States. 


4.3.2 The Constitutional Treaty 


The draft of the Constitution for Europe was prepared by a specially appointed body, 

the Convention on the Future of Europe, chaired by the former French President Valery 
Giscard d@ Estaigne. The Convention completed its work on the draft “Treaty establishing a 
Constitution for Europe’ in 2003. The Constitution was to replace primary law of the 
European Union. The proposed constitution was to repeal the Treaty on European 
Community and the Treaty on European Union and all documents amending and 
supplementing these contracts. At the same time, by virtue of the Constitutional Treaty the 
European Union was to obtain legal personality. The draft of the Constitution for Europe 
divided the competences into competences of the European Union, its Member States and 
shared ones. After adding final amendments to the draft, the treaty was approved by the 
European Council in June 2004. At the same time the ratification process of the proposed 


Constitution of Europe by the individual Member States started. 


In October 2004 representatives of 25 Member States of the Community signed this historical 
document in Rome. Countries preparing for European Union Membership, Bulgaria and 
Romania, as well as Turkey, aspiring to membership in the Community also signed the final 
act of the Constitution. For the Constitutional Treaty to enter into force, it had to be ratified 
by all Member States of the Community. Initially it was assumed that the ratification process 
would last for two years. Depending on the laws of particular countries the Treaty ratification 
was to be carried out by a vote by the national Parliament or by referendum. In the majority 
of the European Union’s Member States the ratification was successful. However, the 


rejection of the document in national referenda by France (May 2005) and the Netherlands 
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(June 2005) stopped the ratification process and ultimately led to the abandonment of the 


proposed Constitution for Europe. 


After the rejection of the proposed Constitution for Europe discussions for a new treaty for 
the European Union continued in 2006. In 2007 the Treaty of Lisbon amending the Treaty on 
European Union and the Treaty establishing the European Community was signed off and 
entered into force on 1 December 2009. The word constitution was taken out of the text of the 
treaty and for the first time a Member State is allowed to withdraw from the European Union 
based on a defined procedure for such a case. The Treaty of Lisbon introduced a unified 
structure of the European Union, eliminating the three pillars of the EU. Nevertheless, the 
treaty kept certain aspects within the Community separate, related to the functioning of the 
Second and Third Pillar: (a) EU competences - the realisation of the EU’s goals and foreign 
policy and safety; (b) shared competences - EU law takes precedence over national 
legislation in Member States, except for certain areas which are in the sole competence of 
Member States; and (c) Member State competences - decisions are made independently by 
the individual Member State. The Lisbon Treaty assigned legal personality to the EU, 
defining the EU as the legal successor of the European Community. The treaty introduced a 
new leadership model in the Council of the European Union by replacing the six months 
Presidency by a model based commonly on three Member States for a period of 

18 months. The treaty further strengthened the role of the European Parliament, providing it 
with new competences in relation to community law, budgetary issues and political control. 
One of the most important changes refers to the voting system in the Council of the European 
Union. By the end of October 2014 a double majority voting system was introduced, which 
equates to a majority voting system under the condition that at least 55% of the EU States 
representing at least 65% of the Community’s population are voting in favour. 

Until April 2012 each Member State was able to demand repetition of a particular voting 


according to the system introduced by the Treaty of Nice. 


4.3.3 The European Criminal Justice landscape after the Lisbon Treaty 


In 1994 the Europol Drugs Unit (EDU) came into existence and was renamed into Europol 
when the Europol Convention entered into force on 1 July 1998. The mandate of the EDU 
was limited to the processing of non-personal strategic information related to the mandated 
crime areas. After the Europol Convention entered into force a more operational dimension, 


including the processing of personal data for the purpose of criminal intelligence analysis was 
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added. However, no executive powers were conferred to the organisation. Having been 
embedded in the ‘third pillar’ structures of the EU the Lisbon Treaty considerably changed 
the role of Europol, now regulated in Art. 88 TFEU. Here, Europol’s mission is referred to as 


to support and strengthen action by Member State’s law enforcement agencies. 


Europol is tasked to collect, store, process, analyse, and exchange information, ‘in particular 
information forwarded by the authorities of the Member States or third countries or bodies’ . 
In addition, the article foresees the possibility of operational activities which are defined as 
‘coordination, organisation and implementation of investigative and operational action 
carried out jointly with the Member States’ competent authorities or in the context of joint 
investigative teams, where appropriate in liaison with Eurojust’. This wording represents 
quite a change compared to the initial non-executive nature of the organisation constituting a 
significant break with the past. Well knowing the far-reaching consequences of this wording 
Member States put in additional safeguards by stipulating that any future regulations as a 
result of Art. 88 require in the first place to lay down procedures for scrutiny of Europol’s 


activities by the European Parliament, together with national Parliaments. 


There will be greater need for the scrutiny of Europol if the organisation gets involved in 
operational activities, interfering with law enforcement activities at national level. It is not for 
nothing that article 88 (3) TFEU includes the word ‘operational’, requiring that operational 
action in a particular territory of a Member State depends on the agreement of its national 
authorities. If coercive measures need to be taken, the national authorities have sole 
responsibility for their use. But that does not rule out the possibility that the measures could 


actually be executed by Europol officers. 
Eurojust and the European Public Prosecutor’s Office 


Although Eurojust and the European Public Prosecutor’s Office (EPPO) only play a limited 
role in the current ECIM set-up it is important to keep the role of Eurojust and the foreseen 
role of the EPPO in mind. In the future, these entities will play an important role for the 


ECIM, especially as a potential source for operational data to be used in the ECIM. 


Eurojust composes of national members from all 27 EU Member States. The national 
members are seconded from Member States’ judicial authorities and can coordinate law 
enforcement activities in cross-border criminal investigations. The cases concerned are 
forwarded to Eurojust by the Member States themselves. Eurojust’s mandate is broad and 


covers a large number of crimes with a cross-border dimension. Eurojust allows Member 
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States to work together more efficiently and effectively in cases involving cross-border 
crime. For example, when a national Public Prosecution Service is investigating a case of 
drug trafficking effecting one or more other Member States and the investigation requires 
arrests, house searches, or the securing of evidence in those other states involved. 

In such a case, Eurojust ensures that these requests reach the right authorities without 
unnecessary delay and are dealt with immediately, by-passing cumbersome requirements 
requested by older concepts related to trans-national mutual legal assistance in criminal 


matters. 


In 2002, when Eurojust was set up the organisation handled just 200 cases. By 2010 this 
number had risen to almost 1.450 per year. Eurojust like Europol demonstrates that a 
European approach to the problem of cross-border organised crime is both necessary and 
effective. Eurojust is referred to in article 85 TFEU: ‘Eurojust’s mission shall be to support 
and strengthen coordination and cooperation between national investigating and prosecuting 
authorities in relation to serious crime affecting two or more Member States or requiring a 
prosecution on common bases, on the basis of operations conducted and information 
supplied by the Member States’ authorities and by Europol.’ Eurojust’s structure, mandate 
and tasks should be determined by regulations. However, Eurojust is not expected to 
undertake operational activities by running its own investigations. It is unclear whether ‘the 
initiation of criminal investigations, as well as proposing the initiation of prosecutions 
conducted by competent national authorities’ , as referred to in article 85TFEU will be 
interpreted a binding activity for national authorities. In any event, resulting prosecutions will 
be initiated at national public prosecutor level, requiring the national public prosecutor to take 


part in the underlying decision making processes. 
The European Public Prosecutor’s Office 


If there is the intention to develop and implement a full-fletched European judicial system 
being empowered to run its own criminal investigations such a system has to be based on an 
executive, a legislative, and a judicial branch, where the European Commission together with 
the European Parliament present the legislator, and Europol the executive arm. 

Article 86 TFEU expands on the judicial angle beyond Eurojust. With regard to crimes 
affecting the EU’s financial interests the Council know may establish a Public Prosecutor’s 
Office (EPPO) by means of regulations. The European Public Prosecutor’s Office will 


operate as a supra-national public prosecution service. 
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The EPPO ‘shall be responsible for investigating, prosecuting and bringing to judgment, 
where appropriate in liaison with Europol, the perpetrators of, and accomplices in, offences 
against the Union’s financial interests’. ... It shall exercise the functions of prosecutor in the 
competent courts of the Member States in relation to such offences’. The details on how the 
EPPO will investigate and prosecute still need to be worked out. It is currently unclear who 
will be carrying out the tasks of the EPPO, e.g. national public prosecution services or 
mandated EPPO officials who would not have national powers. Related decisions must be 
taken unanimously by Member States after obtaining the consent of the European Parliament 
and after consulting the European Commission. If this happens, the EU will take a significant 
step towards having its own criminal justice system. Although the EPPO can be mandated to 
initiate investigations, these investigations have to be carried out by law enforcement 
agencies in Member States. 

Unless law enforcement support for the EPPO is properly defined and structured the concept 
will remain flawed from an organisational perspective, leaving the EPPO without the 
necessary executive arm. Nevertheless, the Europeanisation of law enforcement has been 
advanced quite considerably compared to the limited steps taken over the last decades. 

For this supra-national construct in investigating and prosecuting crime the need for strategic 
guidance is even more important. A well-oiled machinery to provide these strategic insights 


would be helpful. The proposed ECIM offers the blueprint. 
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5. Reflections on the differences between Intelligence and 


Information as the basic ingredient for an ECIM 


Information or Intelligence - does it make a difference? Before addressing the mechanism of 
the ECIM it is important to understand the concept of the model which underlines the focus 
on intelligence rather than information. The quote “An unread book is just like a block of 
paper’ by the American author F. Scott Fitzgerald (1896-1940) is a nicely fitting description 
highlighting the difference between information and intelligence - it is all there, it just needs 
to be taken in and understood in an appropriate way. Meaning needs to be given to the raw 
material at hand. The differences are of fundamental importance, especially as this thesis is 
focusing on a ‘European Criminal Intelligence Model’ and not on a ‘European Criminal 


Information Model’. 


But why this difference? It has to be assumed that the distinction was made on purpose, 
unless information and intelligence are seen as the same thing to be used interchangeably. 
Interchangeability seems to be disputable as by now whole schools-of-thought within the law 
enforcement community have spent time and effort over decades to explain the differences 
between these concepts. Taking a look into the military context where the concept of 
intelligence originally stems from, it shows that the difference between information and 


intelligence is quite fundamental. 


The Oxford Dictionary defines information as ‘facts provided or learned about something or 
someone’, whereas facts are defined as ‘a thing that is known or proved to be true’. 

It follows that information should be seen as ‘something known or proven to be true that is 
provided or learned about something or someone’. Information is a concept of being 
descriptive and objective or rather neutral and of an observable nature - as such information 


does not contain a value judgment. 


Intelligence on the other hand is not linked to the same attributes. Instead of being descriptive 
intelligence is narrative and interpretative. Objective is replaced by subjective, neutral by 
biased (not in a negative sense), and finally observable by amorphous. The following 
statement, more than 2000 years old, is attributed to Sun Tzu: “Know the enemy, now 
yourself; your victory will never be endangered. Know the ground, know the weather; your 
victory will then be total’. This quote is referred to as a description of information 


requirements which are needed to guarantee a successful battle. 
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At the same time this quote also can be seen as a first quote on intelligence, the argument 
being that there is a need to know more than just your own capabilities and those of your 
immediate opponent to have the upper hand. Sun Tzu refers to embedded, environmental, 
circumstantial, or ‘soft’ information, which will impact on the overall outcome. And this is 
what intelligence in a law enforcement context is about. It goes beyond the actual facts or 
available information. It interprets a situation, providing additional and new meaning by 


doing so. Intelligence is a specialized activity applying its own techniques and methods. 


Over the last decades to equal a modern law enforcement approach to tackle (not only) 
organised crime equals the use of intelligence However, it needs to be considered if the 
existing focus on intelligence does not go against the idea of the ECIM in the end. In general 
terms, the ECIM bears strong similarities to a large scale Information Management System. 
From this perspective it could be advisable to exchange the term intelligence for information, 
even if such a change sounds less glamorous. Taking into account that the term intelligence is 
not to be found in any penal code or code of criminal procedure makes this idea quite 
appealing. A lot has been said and written over the concept of intelligence in law 
enforcement. However, a universally agreed definition on what intelligence means still does 
not exist. Intelligence is not a law enforcement invention. There is no doubt that the actual 
concept of intelligence was first expressed in a military context several thousand years ago. 
The first methodological reference to intelligence is attributed to Sun Tzu. In his book “The 
Art of War’ Sun Tzu describes the concept of intelligence in a short story in the following 
way “For 28 days he continued strengthening his fortifications, and took care that spies 
should carry the intelligence to the enemy. The Ch’in general was overjoyed and attributed 
his adversary’s tardiness to the fact that the beleaguered city was in the Han state, and thus 
not actually part of the Choa state. But the spies had no sooner departed that Chao Sen 
began a forced march lasting for two days and one night, and arriving on the scene of action 
with such astonishing rapidity that he was able to occupy a commanding position on the 
“North hill” before the enemy had got wind of his movements. A crushing defeat followed for 
the Ch’in forces, ...”. What does this actually mean for the concept of intelligence? 
According to Sun Tzu intelligence is a specific piece of information or an activity 
(strengthening the fortifications) that should be kept from the enemy to not reveal any 
planned activities to avoid that the enemy can develop and deploy effective counter- 
measures. Intelligence is generated when the protected information/activity is provided to the 


enemy ({He] took care that spies should carry the intelligence to the enemy). There is nothing 
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special about the intelligence provided. It is just information that should have not been in the 
hands of the receiver as the fact that the information disclosed to the receiver gives the 
receiver an unwanted advantage. Information was turned into intelligence just by the act of 
disclosure. The story contains another aspect, the conclusions the receiver of the intelligence 
draws. These conclusions are entirely depending on the perception of the receiver. The Ch’in 
general was overjoyed and attributed his adversary’s tardiness to the fact that the beleaguered 
city was in the Han state, and thus not actually part of the Choa state. The actual underlying 
information remains untouched. When it comes to the consequences of the conclusions drawn 
by the receiver of the intelligence (a crushing defeat followed for the Ch’in forces) the 
responsibility only lies with the receiver of the intelligence as the receiver did not consider an 
alternative scenario to balance the intelligence received against (the possibility of being 


deceived). 


With the concept of the nation state intelligence services came into existence."” The name of 
these services already indicates that one of their main activities was and is the acquisition and 
handling of intelligence. From there it took some time for the concept of intelligence to find 

its way into law enforcement. The first notable reference would be most likely the publication 


by Godfrey and Harris in 197M 


According to Ratcliffe (2005) the use of intelligence in a law enforcement context can be 
described as “the creation of an intelligence product that supports decision makers in the 
areas of law enforcement, crime reduction, and crime prevention’. However, the use of 

intelligence in a law enforcement context in general terms describes a variety of different 


manifestations: 


(a) the specific nature of a piece of information (e.g. when originating from a 
protected source); 

(b) the entire analytical process at the end of which an intelligence product is derived, 
including aims & objectives, data collation, data evaluation, data collation, data 
analysis (integration and aggregation), dissemination, and feed-back; or 


(c) the final intelligence product as a result of the analytical process applied. 


40 «|. the intelligence sector is also a special area of state activity. It has a vital role in safeguarding national 


security.” H. Born and M.Caparini (2007). Democratic Control of Intelligence Services. Ashgate. 
E.D. Godfrey and D. R. Harris, Basic Elements of Intelligence, Technical Assistance Division, Office of 
Criminal Justice Assistance, Law Enforcement Assistance Administration, Department of Justice, 1971 


41 
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What is common to all of these descriptions is the fact that intelligence cannot be used 
unconditionally in formal judicial proceedings. It is missing the evidential character in 
contrast to objective information. The concept of law enforcement intelligence is not limited 
to the simple accumulation of information. Intelligence turns information into another 
aggregate state through the process of analysis. The underlying information may come from 
covert (e.g. infiltration, interception, informants, etc.) or open sources (e.g. Internet, 

public files, criminal investigations etc.). In the next phase collected raw data or information 
is processed by the analyst and re-arranged (interpreted) to represent an incomplete but 
plausible jig-saw puzzle of the actual event. Based on pieces of segregated information the 
available data is synthesized. Possible information gaps need to be filled by assumptions 
linking the available fragmented information. These assumptions or hypothesis later have to 
survive a reality-check. As a result of this reality-check the aggregated information is 
evaluated, which then will result in new knowledge. Intelligence produced should allow for a 
predictive statement that enables law enforcement to take pro-active steps to prevent an 
unwanted development from happening. This process, the creation of new meaning using 


intelligence is summarised in the following chart: 


Creating ‘Intelligence’ 


INTELLIGENCE interpreted and constructed new information 


HYPOTHETICAL LEVEL 
(based on assessed information P1 
but going beyond the facts) 


FACTUAL LEVEL 
(available information) 


I = individual piece of information 
P = premise (thematically clustered information) 
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Relying on intelligence implies (Heur, 1998) that the aforementioned information gaps, 
which are intrinsic to the intelligence process, are filled by means of three different analytical 


approaches: 


e Application of theory, which refers to the use of a generalization by drawing conclusions 


from the study of many examples related to the same phenomenon; 


e Situational logic, which refers to the identification of the logical precedents or 


consequences of the situation analysed; 


e Comparative analogies, which refer to the comparison of the current situation with 
historic precedents by drawing analogies where suitable, or of comparable situations in 


other circumstances. 


As a consequence, law enforcement intelligence is based on a ‘well-judged opinion’ 
compared to what traditionally is referred to as investigative or judicial law enforcement 
which relies on evidence based objective information. There are other basic differences 
between law enforcement intelligence and investigative/judicial law enforcement, which 
further widens the gap between the two. These differences have the potential to create 
misunderstandings when both are used by law enforcement. An investigation is focused on an 
individual case, trying to get the case to court with the aim to reach the conviction of the 
accused, provided the respective evidence being available. Based on the principle of 

‘due process’ the potential success of each investigation depends entirely on the production 
of undoubted evidence. Information used in this context is directed towards this aim. 
Intelligence, on the other hand, does not need to always have such a straight forward purpose. 


Basically, intelligence can be used in three different ways: 
e Immediate operational support - the direct support in a single investigation; 


e Associated operational support - the comparison of different investigations focusing 
either on the criminal group involved or a specific crime type to identify 


common denominators that will help to cluster investigations; 


e Investigation independent intelligence - the identification of new targets for 


criminal investigations, so far not on the current radar. 


In contrast to evidence used in formal judicial proceedings intelligence may be introduced 
into a formal judicial proceeding, whereas evidence always has to be introduced. 


Of course, there is the option to convert intelligence into evidence. 
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However, often a major hindrance in doing this conversion is linked to the necessary 
protection of the source. This necessary protection might be contradictory to the requirement 
of disclosure and can lead to difficulties with regard to the judicial use of the intelligence 
provided, even if it contains valuable information, in case it cannot be extracted from the 
intelligence without endangering its origin. Intelligence in law enforcement can be used 
outside the immediate investigative context, not linked to an investigation. These areas can 
refer to (a) the forecasting of crime trends where they will occur and how they might develop 
or even identifying new forms of crime not yet exploited by criminal groups, etcetera; 

(b) monitoring the daily activities of a criminal organisation to identify patterns that will 
allow effective countermeasures and prosecution; (c) the identification of potential 
vulnerabilities of a criminal organisation and potential points for infiltration or the use of 
possible informants; or (d) the development of an effective disruption strategy of illegal 
activities of a criminal organisation for a longer period of time. This list is not exhaustive and 


is meant to just highlight the diversity that is covered under the concept of intelligence. 


The huge spectrum covered by the concept of intelligence described above indicates the 
difficulty that one encounters when proposing the introduction of a common intelligence 
model at EU level. However, the decision to call for a European Criminal Intelligence Model 
implies that the founders of the ECIM have taken a conscious decision to promote the 
intelligence character of the model. It is hoped that this decision also anticipated the potential 
difficulties the implementation of such a model might entail. A postmodern context supports 
this decision. By moving away from a purely factual model to a model based on interpretative 


data the ECIM is better equipped to be embedded in a postmodern setting. 
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6. The basic concept of a ‘European Criminal Intelligence 


Model’ in light of Ratcliffe’s 3-i-model 


Having addressed challenges regarding the use of intelligence versus information when 
introducing the ECIM there is need for additional discussions. Does a European Criminal 
Intelligence Model refer to a ‘Criminal-Intelligence Model’ or a “Criminal Intelligence- 
Model’ or is the place where to put the hyphen irrelevant? At first sight it sounds like an 
academic discussion which does not seem to bear a practical link to the reality of daily 
policing. Interestingly enough, the vast majority of literature in this area actually does instead 
of referring to ‘criminal intelligence’ only refer to ‘intelligence’ as a concept in applied law 
enforcement methodologies (Ratcliffe, 2003). This could support the argument that the 
hyphen-problem is just an artificial play on semantics without any substantial meaning. 
However, taking a closer look at the potential consequences shows that it is indeed 


worthwhile to spend some more thoughts on the issue. 


What then is the difference between criminal-intelligence and intelligence used to tackle 
organised crime? The difference actually touches the heart of self-perception of law 
enforcement. Traditional policing revolves around crime and the criminal responsible for 
committing it.” This has been and still is quite a straight forward and two-directional 


relationship allowing law enforcement to have a well-defined position within society as the 


only mandated problem-solver when tackling crime: 


Criminal Environment 
(Crimes and Criminals) 


investigate impact 


Law Enforcement 
Response 


“ H. Goldstein, ‘Improving policing: A problem-oriented approach’, Crime and Delinquency, 
vol. 24, April 1979, pp. 236-58 
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With the emerging of organised crime this situation has slowly but constantly changed. 

The law enforcement community was in need to develop a different approach for effectively 
tackling organised crime to incorporate these changes in their response to crime which had 
become more complex, more organised, and more trans-national. Some 15 years ago a new 
concept and a new component entered the playing field. This concept introduced the 
component of intelligence in the law enforcement response to organised crime. 

The concept is referred to as Intelligence-Led-Policing (ILP). As a result, the existing 


relationship between law enforcement and organised crime also had to be altered. 


Ratcliffe (2003) introduced the following basic model including the intelligence component. 
Introducing intelligence meant that the initial investigative relationship between law 
enforcement and the criminal environment was split into two different components: 


(a) interpretation and (b) influence. This model is also referred to as the *3-i Model’: 


Criminal 
Environment 
(Crimes, Criminals) 


interpret impact 


Decision Maker 


Intelligence function influence (Law Enforcement) 


The change in this new model did not seem dramatic, especially as the new triangular concept 
still represented a straight forward linear relationship between the individual components. 
However, the consequences were far reaching. Law enforcement was losing its robust 
foundation based solely on the concept of investigations by allowing space for a new 
relationship that was not simply based on the concept of evidence - a notion of uncertainty 
was added to the existing equation. According to the self-perception of traditional policing, 
introducing ILP represented a quantum leap like accepting that the atom did not represent the 
smallest parts in the universe. A new paradigm needed to be commonly accepted. 

In this context it needs to be highlighted that even until today this process has not been 


finalised. 
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With regard to the concept of a European Criminal Intelligence Model the *3-i Model’ also 
provides some insight related to the difference between criminal-intelligence and intelligence 


in acrime related context. 


Ratcliffe’s model suggests that it is not important to distinguish between these two 
approaches. In Ratcliffe’s *3-i Model’ the intelligence function interprets the criminal 
environment. Therefore, the intelligence function will produce criminal-intelligence - 
intelligence that by definition is generated from within the criminal environment, focusing 
primarily on the components of SWOT analysis (strength, weaknesses, opportunities and 
threats) in relation to the criminal organisation involved. Unless, it is assumed that Ratcliffe’s 
‘criminal environment’ was already meant to include additional dimensions like political, 
economic, social, technical, environmental and legal developments which are known as 
PESTEL analysis. Not seeing that any further comments can be found by Ratcliffe explaining 
in more detail why only intelligence instead of criminal-intelligence is used within the 

*3-i Model’ it seems more likely that the model did not include the aforementioned PESTEL 


components. 


Starting from this assumption indicates that the ‘3-i Model’, although providing a new 
conceptual framework for policing, might need to be further expanded to include non- 
criminal intelligence components (PESTEL factors) as a vital ingredient to a more complete 
model based on a holistic perspective. In the context of this thesis this change is also required 
as a consequence of the fact that current policing models need to take into account that 
societal changes have moved the world at least into a late-modern or even post-modern set-up 
as such a development puts the contextual framework in the centre of attention. 


An amended ‘3-i Model’ revised in line with these ideas looks as follows: 


. ‘ existing relationships 

Intelligence (traditional policing) 
Joie required relationships 

led policing (intelligence-led-policing) 


criminal 
environment 


influence 


non-criminal 
environment 


interpret 


criminal \ involvement 
investigation . 
\ 
\ 


influence 


interpret 


‘guide’ 


interpret 


Intelligence 


\ 
\ 


LEA 
Decision Maker 


influence 
? lead ? 
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The revised *3-i-Model’ represents a much higher complexity as the original model proposed 
by Ratcliffe. At the same time this model remains a closed system, taking into account a 
multi-layer reality when it comes to the relationship between the criminal environment and 
the law enforcement community embedded in a societal context. In more explanatory detail 
the revised model keeps the 3-i-triangle but expands the triangle by the non-criminal 
environment and the ‘beyond police cooperation’. In addition, within the traditional triangle 
the criminal investigation as an independent entity is added. Overall, the revised model is 
more difficult to be balanced out as more interdependent variables are to taken into account 
and interpretative aspects take a more prominent role. However, such a model seems to be 
better suited to reflect the current framework to be looked at when developing a holistic law 
enforcement intelligence model. Again the proposed extended 3-i-model also reflects a more 
complex reality including influencing factors that are not always tangible. Although this 
perspective is different to a traditional law enforcement view which is based on facts it takes 


into account aspects related to uncertainty as they would be present in a postmodern society. 
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7. The non-criminal environment (relevant contributors 


beyond the investigative context) 


The criminal environment (the actual criminal investigation) does not exist in a vacuum but is 
part of a societal configuration which mainly consists of PESTEL variables, variables that 


‘ pe ous . : dgi-td : 43 
define a specific non-criminal environment and influence the criminal environment. 


7.1 Geographical peculiarities 


From a European perspective these PESTEL variables are not only country specific when it 
comes to trans-national organised crime. General regional geographical peculiarities are as 
important. The Baltic Sea Region is an example highlighting the need to reflect on these 
peculiarities. Neighbouring countries to the Baltic Sea are Germany, Poland, Sweden, 
Denmark, Russia, Finland, Sweden, Estonia, Lithuania and Latvia, representing a unique 
mixture regarding size, population, and the aforementioned individual PESTEL variables. 
Each of the countries represents a specific non-criminal environment as a result of the 


specific national framework.* 


However, it would be negligent if the national non-criminal environment was not matched by 
the specific geographical and geo-political circumstances provided by the Baltic Sea as a 
common region. On the one hand there are the Scandinavian countries (Denmark, Finland, 
and Sweden) and the Baltic States (Estonia, Latvia, and Lithuania) already bound by a special 
Scandinavian respectively Baltic regime which defines a very distinct trans-national non- 
criminal environment. On the other hand there are Germany and Poland, individual states 
linked by a special historical relationship. All countries neighbouring the Baltic Sea are 
members of the European Union except for Russia, the final player in the game who adds 
another layer to the regional non-criminal environment. All these factors are important when 
considering the potential success of a European Criminal Intelligence Model. The Baltic Sea 
Region is a striking example of how complex the non-criminal environment can be. 


Similar regional differences can be observed all over the European Union. 


“’ One could even argue that the PESTEL variables determine the criminal environment that can be found in a 


specific region or country. 
Although it could already be argued to which extent a big country like Germany can be described as a single 
entity when it comes to influencing factors generated by the non-criminal environment. 
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In the end, the European Union represents a melting pot of different geographical regions, all 
defined by regional relationships, e.g. the Balkan region, the Channel Tunnel region 
(effecting the Netherlands, France, Belgium and the United Kingdom), the Mediterranean 
region, and the Atlantic region. These individual regional peculiarities define which shape 
organised crime will take. It looks as if Europe from a law enforcement perspective is rather a 
patchwork quilt than a monolithic structure. This needs to be taken into account when 


implementing the ECIM. 


7.2 Cooperation beyond the law enforcement context 


Policing has changed. The demarcation line between what is part of traditional policing and 
what is not has been fading for decades.*” Also the concept of policing as an independent 
discipline within society, solely functioning by applying the penal code together with the 
code of criminal procedures is doubted. Society has become too entangled and complex to 
allow only for a one-dimensional law enforcement perspective. A successful law enforcement 
response to crime mainly based on modern principles is not sufficient anymore. 

Policing has taken on many additional tasks that are beyond traditional policing. 

Law enforcement activities nowadays overlap with those that are attributed to a social or a 
community worker, a mediator, or a health authority. The same goes the other way round. 
Many institutions nowadays have an extended mandate which in modern times would solely 
be attributed to traditional policing. Therefore, non-police cooperation cannot be excluded in 
an updated intelligence model when it comes to effectively tackle all forms of organised 
crime, e.g. youth gang crime, large scale credit card fraud, contraband, etc. Whatever the law 
enforcement response might be, law enforcement activities alone will not provide the 
appropriate means to address and solve the problem. The same applies to organised crime 
where sometimes only legislative or administrative changes to the overall framework outside 
the sphere of influence of law enforcement will stop certain types of organised crime. Two 
examples being the concept of crime proofing of new legislation and the so-called 


administrative approach taken by the Netherlands.*° 


See for example: C. Nemeth, Private Security and the Law (Fourth Edition), Elsevier, 2012 

“© T. Vander Beken, Organised crime and vulnerability of economic sectors. Antwerp, Maklu, 2005; 
H. Nelen and W. Huisman, “Breaking the Power of Organised Crime? The Administrative Approach in 
Amsterdam’, Organised Crime: Culture, Markets and Policies, Studies in Organised Crime, vol. 7, 2008, 
pp. 207-218 
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Non-police cooperation in the public domain should not be too difficult to be developed. 
However, there is also the private domain which needs to be included in these thoughts. 

It might be just a private insurance or credit card company that has the actual means to 
disrupt or stop criminal activities, e.g. by introducing of an electronic engine immobiliser in 
cars or by replacing the magnet strip on a credit card with a microchip. Like with the 
non-criminal environment, an intelligence model to work at European level depends on 
successful non-police cooperation in the public and the private domain, taking into account 
that the global economy has abolished national borders decades ago, making economic 
drivers an important player in any trans-national organised crime setting. The specific role of 
the private sector will be explained in more detail in the following pages. An ECIM with the 
Organised Crime Threat Assessment (OCTA) as its core component has to integrate a variety 
of non-traditional law enforcement sources with the law enforcement community in Member 


States remaining its major contributor. 


7.3 Trans-national law enforcement 


Other contributors at European level need to also contribute to a holistic ECIM. Such multi- 
layer input further highlights the exposure of law enforcement to the impact of a post-modern 
society. The traditional role of national law enforcement as the only entity to centralise 
information related to organised crime is vanishing. Trans-national organised crime is more 
and more dealt with in a trans-national context. As a result of the evolution towards the EU 
and especially after the entry of the Lisbon Treaty the European Union has given the mandate 
to tackle organised crime to a variety of different players like Eurojust, Frontex (European 
Border Management Agency), or OLAF (European Anti-Fraud Agency). Current discussions 
with regard to the proposed setting-up of a European Public Prosecutors Office add yet 
another layer to the model. It would be careless to not include these agencies as potential 
contributors for the OCTA. The specific context for Eurojust and the European Public 
Prosecutor’s office is further elaborated in chapter 7 on ‘Europeanization’. All these 
European agencies have a mandate to tackle organised crime. Eurojust is supposed to take a 
European perspective on prosecutorial aspects, whereas Frontex focuses on illegal 
immigration and trafficking of human beings. OLAF is mandated to investigate fraud cases 
where the interests of the EU are concerned. In addition, OLAF has the mandate in the area 


of contraband goods, specifically the smuggling of cigarettes. 
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This brief outline shows that there might also be some overlap with the findings generated by 
the police at national level. The diversification of responsibilities for investigating organised 
crime fits into the concept of a post-modern society where monolithic and one-dimensional 
concepts - investigating organised crime as the sole responsibility of law enforcement 
agencies at national level - are replaced by multi-facetted concepts all addressing the same 
problem but from and with a different perspective. For developing a holistic European 


perspective in the ECIM input also from these agencies is important. 


What applies to the national perspective also applies to the trans-national level. There is a 
variety of different agencies involved in the fight against organised crime at European level. 
In addition to Europol, Eurojust, OLAF, and Frontex other organisations like the European 
Central Bank (ECB), the European Intelligence Centre (INTCEN), or the Baltic Sea Task 
Force have their share. Again this variety requires a joint understanding on the necessary 
information to be provided to feed the ECIM, including common data standards for these 
agencies based on the requirements outlined in the ECIM concept. It will be an individual 


decision to which extent which agency will be able to provide such information. 


The development of organised crime in Europe is also influenced by factors which are based 
outside the European Union. The holistic strategic dimension of the ECIM does not stop here. 
To identify new emerging trends in organised crime it is also necessary to integrate 
information from ‘non-EU’-sources. Although the ECIM and therefore the OCTA focus on 
the European Union the European Union cannot be looked at in isolation. 

Taking globalisation into account leaves the European Union in a spider web of influencing 
factors which to a large extent originate from outside the European Union. When it comes to 
organised crime impacting on Europe information/intelligence regarding groups based in 
South America and West/North Africa is vital for being able to analyse and evaluate the 
developments and the actual threat posed by illegal drugs trafficking. In the area of organised 
contraband information from China and other South East Asian countries is crucial. 
Trafficking of human beings can hardly be attributed to a specific region on the globe. 

The same limitlessness applies to fraud, especially when committed via the Internet. 
Consequently, input from non-EU countries, other international organisations like Interpol, 
Aseanapol, Ameripol, Liaison Officers from EU countries based outside, Liaison Officers 
from non-EU countries based in the EU, and the World Customs Organisation (WCO), 

has to be included in the data collection plan for the ECIM. It could be easily said that the 
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conceptual model of the ECIM and the OCTA is a striking example to give credit to the often 
used phrase ‘Think global, act local’. 


7.4 Integrating non law enforcement sources 


The next set of sources to be integrated in an OCTA falls into a different class: information 
available from academia, non-governmental organisations, and the private sector. 

Academia approaches the world of law enforcement from a scientific perspective, offering 
another perspective on the same subject area. In addition, academia does not limit itself to the 
crime side of things. Academia is also researching the role law enforcement plays related to 
the crime phenomena, providing an alternative insight in relation to what and how law 
enforcement is doing. This approach helps to better understand if law enforcement is doing 
things right or the right thing, and it is this reflection that brings law enforcement into a social 
context. The resulting discussions and challenges might be uncomfortable but are necessary 


for an ECIM to take a holistic perspective. 


The private sector as a source of information is of specific interest as the business sector is at 
the same time direct victim to many organised crime activities (e.g. fraud, contraband). 

This of course makes the role of the private sector ambiguous as the business sector pursues 
its own aims and objectives and not always has an unbiased agenda. Information related to 
organised crime activities is collected and analysed by private companies to allow them to 
better understand and plan their business activities and to develop successful non-law- 
enforcement counter-strategies. In many cases the information available to the private 
industry is not coordinated with or communicated to the respective law enforcement 
agencies. Reasons for not-reporting might be that the success rate of a criminal investigation 
is low, the private sector has no interest to make a specific vulnerability known to the public, 
the private sector has a functioning internal sanction mechanism in place, or going public 


might simply have a negative impact on profits. 


At the same time the private sector wants to receive maximum attention from the law 
enforcement community to protect its specific interests. To achieve these goals the private 
sector might be inclined to provide skewed information to turn its agenda into tangible 
results. The lack of institutionalised co-operation between law enforcement and private 
industry can also be observed in the context of continued privatisation and segregation in the 


security sector, a domain so far exclusively dealt with by law enforcement agencies in 
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Member States. Often, these new relationships are better described as competitive rather than 
cooperative. Collecting available data on organised crime from the private sector provides 
another dimension in the holistic approach for analysing organised crime adding another 
qualitative and quantitative element by taking a different perspective on organised crime 


activities in the EU and beyond. The following two examples will illustrate these aspects. 


Credit card fraud is a criminal activity, which for example is committed in a banking 
environment when opening an account under a false name. Depending on the country the 
opening of a bank account requires a valid [D-document to prove the identity of the applicant. 
In case the bank has doubts about the authenticity of the [D-document the bank will stop the 
opening of the account. The applicant will then not further pursue the opening of the account 
and just move to another bank to get the account opened. The applicant, if using a false 
ID-document will have no interest to report the incident to the police. Unfortunately, also the 
bank will have no interest in reporting the attempt to open an account by using a false ID, 

as there was no negative consequence for the bank and an involvement with law enforcement 
would only entail additional work without any additional benefit for the bank. As a result, in 
many cases the respective information related to false [D-documents used remains with the 
bank. For those reasons, the actual dimension of potentially fraudulent accounts remains off 
the radar of law enforcement unless the bank has an interest to make the problem public. 
Another interesting crime area is linked to the credit card itself. By introducing the so-called 
EMV card*’ the common magnetic strip on the card was replaced with a chip. The EMV card 
is no cure-all for credit card related crime as the introduction of the chip was not intended to 
eliminate fraud if a card is lost or stolen. Introducing the chip was mainly aimed at reducing 
counterfeiting. In back-tracking this change initiated by the credit card industry it can be 
deduced that the problem of counterfeit credit cards must have had a considerable financial 
impact on the business of banks and credit card companies that was not to be neglected. 
However, the dimension of the problem never made it to the (law enforcement) headlines, 
even as the law enforcement community was aware of the potential vulnerability of the 
magnet strip to counterfeiting. The magnet strip enabled fraudsters to retrieve individual 
credit card numbers and expiration dates from the card to manufacture counterfeit cards. 


The business sector was in a kind of dilemma. 


“7 Named after three organisations introducing the card: Europay, MasterCard, and Visa 
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On the one hand they needed the attention of law enforcement to prioritise the fight against 
counterfeit credit cards on the other hand the sector could not really publish available 
figures.In a postmodern setting the private sector has to consider which information is shared 
as the sharing will trigger a variety of different reactions. Taking on the ‘profit hat’ 
publishing these figures would have resulted in a sharp decline of the credit card business as 


customers would have been aware of how vulnerable the cards were. 


The second example refers to the counterfeiting of goods like cigarettes, music CDs, or 
medical products. Again, the business sector has conflicting interests in addressing these 
crimes with the law enforcement community. These types of crime belong to the category of 
‘low risk - high profit’ crimes, due to a relatively low detection rate and a low sentence in 
case of being investigated and brought to trial. Knowing about these facts, the business sector 
prefers to keep the matter in its own hands by employing private investigators to track down 
illegal production sites and to stop illegal goods from entering the market. Related activities 
often take place without the involvement of law enforcement, which leaves law enforcement 
as second hand receiver when it comes to quantifying and qualifying the problem. 

Law enforcement agencies have to assume that the data reported by the business sector in 


relation to those crimes mirror the real situation and are not biased by business interests. 


There is yet another source of information to be considered to complement the picture: open 
source information. To include open sources in the data collection plan for the OCTA can be 
disputed as reliability and validity of open source information, especially in the area of law 
enforcement and organised crime is difficult to assess. Nevertheless, can such difficulty be 
reason enough to exclude open source information? Evaluation of information represents the 
core of the intelligence cycle. Going back to the original 4x4 system for the evaluation of 
information it needs to be remembered that this evaluation mechanism always considered that 
information cannot always be taken at face value. Therefore, the value of the information is 
downgraded accordingly but not excluded. Even isolated information from unknown source 
is included in the intelligence cycle and coded respectively. The source is evaluated ‘D4’ or 
*X4’ (depending on the matrix used), which indicates that the reliability of the source cannot 
be assessed and that the actual information is not known personally to the source and cannot 
be corroborated. What is required is that premises drawn from such sources are carefully 
counter-checked during hypothesis testing. The potential usefulness of open source 
information to be used for the (S)OCTA is illustrated by the availability of a variety of 


personal interviews of high profile criminals in the media. As a human being also a criminal 
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likes to receive attention by the public and talking to the media provides such a platform. 

In addition, the media is willing to pay money for these interviews, which explains that open 
sources sometimes have direct access to criminal information which otherwise would never 
be available to law enforcement.*® As said before, such information has to be treated with 


caution but ignoring such information would be unjustified. 


‘8 E.g. various interviews with members of the Hell Angels or the Mafia 
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8. Missing out on non-factual data available to 


law enforcement 


Data from ‘unsuccessful’ investigations do not appear in the existing data collection process. 
Unsuccessful investigations can be defined as investigations that did not make it through to 
court, either because the prosecutor was not convinced of the evidence provided or because 
the investigation was dismissed by the investigators half-way due to the unavailability of 
sufficient information that would offer an chance for a possible conviction. This might be a 
relic from traditional law enforcement concentrating on facts. An investigation that was not 
pursued does not equate to such a concept. However, discarding the potential value of such 
information is missing the point with regard to ECIM being based on an intelligence 
component. A review of the relationship between investigations and resulting court cases and 
convictions will explore the argument by highlighting the potentially available law 


enforcement data that remains unused until today. 


In 2011, according to the official German crime statistics the German police recorded just 
over 6 million individual crimes. Out of these 6 million cases around 3.4 million cases could 
be linked to one or more individual suspects. After reducing these cases by cases committed 
by the same suspects there were just over 2 million individual suspects identified. 

Only 42.000 individuals out of the 2 million identified suspects received imprisonment as the 
final sentence.”” Not too impressive a figure taken into account the efforts put into 
investigating 6 million cases to start with. These figures demonstrate a striking difference 
between the data initially available to law enforcement and the refined data available after the 
judicial process has taken ‘its toll’. It remains the need for another research project to be able 
to establish which of those two figures in the end is the better representation to reflect a law 


enforcement reality. 


These statistics do not distinguish between ordinary and organised crime. Interesting enough, 
the available data on organised crime for the same year, published by the BKA in the 
‘Lagebild Organisierte Kriminalitaet 2011’ (Organised Crime Situation Report) does not 
contain any reference to a conviction rate. However, older reports contain references that are 


similar to the explanations just provided for the meaning of the aforementioned statistics. 


* A more detailed account regarding these statistics will follow on page 54. 
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The German 2004 Organised Crime Situation Report states that ‘taking into account the 
problems linked to dark figures in the area of organised crime awareness needs to be raised 
that the organised crime situation report rather describes the current law enforcement 
approach to organised crime than the actual trends and developments of organised crime in 
Germany’. There is no information to be found why this statement in more recent 
publications is omitted. For the ECIM this quote reveals a major deficiency of the OCTA as 
the basic ingredient. Law enforcement data only refers to data where a suspect has been 
identified and an investigation has been launched. The majority of these investigations is 


based on crimes that have become known to the police. 


8.1 Strengthening the intelligence component in law enforcement 


Over the last decade this re-active law enforcement approach has been complemented by a 
more proactive analytical intelligence function focusing on identifying new investigative 
leads without a crime being reported in the first place. This type of intelligence was 
developed to enable law enforcement agencies to take a more pro-active approach based on 
general patterns which might point towards a criminal activity involved. For example, a non- 
crime related situation of interest to be further analysed could refer to the revenues of 
restaurants in a city that are known to have only a limited number of customers over several 
years but have not changed ownership (something one would expect if business is not going 
very well). Now, it might turn out that the same restaurants have an annual tax declaration 
which is contrary to the aforementioned business picture. At face value, there is no immediate 
criminal activity involved as there might be a plausible explanation for the described 
discrepancy but it might also be that such a plausible explanation does not exist. If the latter 
is the case there is the possibility for the restaurants to be used as a money laundering scheme 
for assets gained from criminal activities. Intelligence analysis units will spend time and 
resources to collect necessary background information and intelligence to be able to 
determine which business relations these restaurants maintain, what the actual owners of the 
restaurants do in addition to running the restaurant, with whom the restaurant owners have 
contacts, what these contacts do, and if there is somewhere along the line information that 
could further substantiate the possibility that money laundering involved. Even if it was 
possible to obtain the respective information the next step needs to be taken, to establish the 
criminal offence triggering the money laundering activity. Otherwise it will be difficult to 


open a criminal investigation as the existence of a predicate offence is the prerequisite for 
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establishing a money laundering offence in most Member States. Giving credit to the analysis 


unit involved and the available information it might be possible to construct this link. 


The final step to transform the analytical approach into a criminal investigation is often much 
more difficult to take. To open a criminal investigation most jurisdictions in Member States 
of the European Union require ‘facts’, especially civil law countries.°° In general terms, 


a hypothesis as a result of the aforementioned analysis could satisfy these requirements. 


The difficulty is that it is still possible that the evolving investigation will not produce the 
necessary factual evidence to get the case watertight. On the other hand there are numerous 
other cases available where on top of the crime committed the potential suspects also are 
‘readily available’. This is where the dilemma starts. Why taking a risk and investing 
resources in a case that can turn both ways, if the ‘stress-free’ alternative is in the same 
basket? From an effectiveness-only perspective no one can be blamed for choosing the easy 
option. The efficiency-perspective looks slightly different and takes into account the equation 
of doing things right instead of doing the right thing. The fact that there is so much ‘obvious 
crime’ to choose from brings law enforcement in a kind of Catch-22 situation. Although there 
are other choices available like investing in the uncertain analytical endeavour which can 
result in new knowledge it is almost impossible to make this choice. If such a choice does not 
result in a conviction law enforcement will be judged as being ineffective. Media will be 
quick to demonstrate that there have been enough other “obvious crimes’ that were not 
investigated although the necessary evidence would have been easy to be obtained; that law 
enforcement wasted precious resources. Not an unexpected behaviour in a post-modern 
society, where judgements on specific situations are taken in an opportunistic manner if it 
serves the own purpose (although this would already represent an abuse of the principles of 
such a society as the actual post-modern aspect would be simply to judge the same situation 
from a different perspective and this different perspectives being neither better or worse). 
Perhaps it is this dichotomy law enforcement has to deal with which is the reason that the 
priority list of crime areas representing the highest threat potential has remained almost 


unchanged over the last decade. 


°° Decision by the German Constitutional Court 2013 regarding the requirements to start a criminal 
investigation (BVerfG 2 BvR 389/13): The initial suspicion to start a criminal investigation has to be based 
on facts which can explain the possibility that the suspect has committed the crime under investigation. 
Indications and speculations are not sufficient ([der] Anfangsverdacht muss eine Tatsachengrundlage 
haben, aus der sich die Méglichkeit der Tatbegehung durch den Beschuldigten ergibt. Vage Anhaltspunkte 
oder blofBe Vermutungen geniigen nicht). 
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This discourse indicates that information used for the OCTA is to a large extent based on 
information deduced from investigated and previously reported crimes and does not consider 
the value of information related to investigations that from a result-driven perspective would 


be judged as failure. 


8.2 Setting strategic priorities based on behavioural patterns 


As mentioned, the new methodology for the OCTA, developed for the new Serious and 
Organised Crime Threat Assessment SOCTA) puts an emphasis on qualitative data exploring 
the ‘behaviour’ of an organised crime group. Information related to the behaviour of an 
organised crime group normally is not captured in great detail by a criminal investigation. 
The subject of a criminal investigation is an individual as only an individual can be convicted 
for committing a specific criminal offence. Although in many jurisdictions an offence related 
to conspiracy exists the application of the respective penal code provisions is rarely used. For 
an organised crime group it is not important which final stage the criminal investigation 
reaches unless an investigation has the potential to completely dismantle the criminal 
organisation involved. Organised crime groups know that if their members come under the 
law enforcement radar these members might end up in prison. What is important for the 
organised crime group is the fact that their activities have triggered the interest of law 
enforcement. As a result the members of the group might suspend their criminal activities, 
and will start to destroy possible evidence linking an individual to a criminal activity. 

What members of an organised crime group will do for sure is analysing the reasons why 
their criminal activities have created a law enforcement interest in the first place. If there is 
no informant or an undercover agent involved it is likely that it was exactly the behavioural 
pattern of the members of the organisation which led made to an investigation. 

As a consequence of the analysis, the criminal organisation will learn and change their 


behavioural pattern accordingly. 


For the ECIM to be a success it is of utmost importance to be able to identify the group’s 
behaviour. Analysing the behaviour and identifying possible means to exploit these 
established patterns will lead to more successful investigations and provides the needed 
insight to be able to determine the actual threat level presented by the group. If a criminal 
investigation is successful leading to the disruption or in an ideal scenario to the dismantling 
of the group the usefulness of related data for the (S)OCTA might even be limited. In the case 


of disruption the organisation will have lessons learned and a new adapted modus operandi 
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will be considerably different to the one established during the investigation. If the group has 
been dismantled the criminal business has failed. This of course does not mean that the 
crimes associated with the group’s activities will seize to exist. The generated gap will be 
closed by another criminal group taking over. To which extent this new group is an existing 
group that just expands its criminal activities, a group which combines the branches of 
different groups or a group that is really new remains to be determined. However, data 
available related to the dismantled group will not be helpful in developing future-oriented 
counter-strategies. The old Serious Crime Report was heavily criticised because it was 
relying on historical data, in some instances relying on information even older than one year. 
As a consequence, the new (S)OCTA is supposed to integrate almost live data, data related to 
investigations which are currently ongoing. This is a great step in the right direction. 
However, as the (S)OCTA is meant to be able to identify specific types of threat posed by 
organised crime and organised crime groups involved, it needs to be considered if timeliness 
of information is the only crucial variable in the equation to develop a future oriented ECIM. 
As argued, identified behaviour of an organised crime group is as crucial as timeliness and 
therefore the (S)OCTA could miss out on an important ingredient if the data collection plan 
does not include data from ‘embryonic’ investigations. This refers to investigations that yet 
have not been formally opened or investigations that were stopped at an early stage in the 
process due to a missing prospect of success from a law enforcement perspective. It is exactly 
those “‘non-investigations’ which can provide the necessary insight to make the (S)OCTA 


a much more effective tool. 


For analysing the threat level attributed to individual organised crime groups the (S)OCTA 
relies on the following indicators: international dimension, corruption, adaptability and 
flexibility, resources, legal business structures, multiple crime areas, cooperation, expertise, 
external violence, and countermeasures. This list goes beyond the original list used for the 
initial OCTA methodology. Information related to these indicators will also be available from 
investigations that have not been further followed up. It can even be argued that data from 
these investigations is more important to develop an understanding of the actual threat posed 
by organised crime groups as the group was able to avoid a successful investigation against 
its members and its illegal activities. This could be one of the main reasons to promote 

a European Criminal ‘Intelligence’ Model instead of a European Criminal ‘Information’ 
Model. Taking a holistic approach for the ECIM can only work if data collection in Member 


States follows the same principles. To see to which extent these efforts are streamlined the 
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website of the National Crime Agency (NCA) in the UK provides some indications. 

The website offers a ‘crime threats’ section.’ The section refers to crime types; organised 
crime groups are not mentioned. Further reading with regard to very traditional crime types 
like drugs trafficking reveals little more information on organised crime groups involved. 
Much is written about different types of drugs and where they originate from, but again, the 
section on ‘organised crime involvement’ in drugs trafficking does not contain specific 
information regarding these organised crime groups. The reason for such a limited reference 
to organised crime groups might be based on the fact that law enforcement in the UK does 
not want to give away indications on which groups are the main focus of law enforcement 
activities. If that is the case the question remains why much more detailed information on 
organised crime groups is accessible on Europol’s Website via the public version of the EU 
Serious and Organised Crime Threat Assessment (S)OCTA. Another reason for a limited 
reference to organised crime groups could be based on the fact that the actual organised crime 
group involved in a criminal activity is only of secondary importance. In the end for the 
society suffering from a specific crime phenomenon it does not make a real difference if 
heroin is imported and distributed by a British, a Columbian, or a mixed group with a 
hierarchical or flat command structure, that used violence to maintain its prominent position 


in the market and which uses legal business structures to disguise its illegal activities. 


The availability of heroin has been and remains a major problem in the European Union. 

It is not surprising that the NCA as the successor to the Serious Organised Crime Agency 
(SOCA) focuses on the actual criminal activity and not so much on the organised group 
involved. The primary objective of SOCA was to reduce the harm organised crime inflicts on 
society and the crime type plays a much more prominent role in when harm is in the centre of 
attention. In Germany, aims and objectives of the Bundeskriminalamt (Federal German 
Police Headquarters) are different. The national Organised Crime Situation Report focuses on 
the organised crime groups. The report is produced annually since the early 90s and evolved 
over the years from being purely quantitative to include qualitative components, although the 


actual title of the report never changed (Bundeslagebild Organisierte Kriminalitaet). 


However, the focus of the national German report does not really overlap with the data 


collection requirements outlined for the (S)OCTA. 


°! Natioanl Crime Agency — NCA, Crime threats, http://www.nationalcrimeagency.gov.uk/crime-threats, 
viewed on 12 May 2015 
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Some arguments have already been provided to explain these discrepancies but there could be 
a more fundamental problem: the (S)OCTA and the ECIM exist in a ‘parallel world’ in 
comparison to national approaches taken to tackle organised crime. It is also possible that the 
conceptual model is simply too detached from a national law enforcement perspective or the 
(S)OCTA is focusing on the wrong variables. To a certain extent all of this plays a role. At 
national level law enforcement has to produce tangible results in acting against organised 
crime (e.g. seizures, arrests, or convictions). National law enforcement activities are 
operationally driven and strategic assessments need to be directly linked to the operational 
environment. If this link is not imminent it is difficult to demonstrate its added value, 
especially if strategic findings cannot be easily transformed into operational activities (or an 
investigation). In this case a strategic assessment is regarded as a ‘luxury’ that not many 
national central law enforcement agencies can afford without risking their credibility by 
spending resources on issues that do not have an outcome. The possibility that the conceptual 
model for the (S)OCTA and the ECIM is based on wrong premises can also not be ruled out. 
Although the conceptual models for both were developed in close cooperation with Member 
States it has to be admitted that the input from Member States also came from colleagues who 
were working in the strategic section within their national settings. It should be expected that 
there was a close coordination process between the representatives from Member States and 
the operational side of the house at national level but the experience gained by the author in 
this process rather points in the opposite direction. A critical reflection shows that the 
exercise for developing the (S)OCTA and the ECIM resembled more a ‘playing field’ for 
strategic analysts to put into action those ideas that were not possible to implement at national 
level. The result might be like the blueprint for a perpetual motion machine which turns out 


in the end to be a blunder. 


The last aspect, focusing on the wrong variables, can also not be discarded as a lot of the 
necessary information required for the (S)OCTA simply is of limited or even no importance 
from an operational perspective as explained earlier in this paper. In addition, the variables 
used start from the old premise that organised crime in principle behaves like a business 
enterprise, as organised crime is profit oriented and only differs from ordinary business 
models by the fact that the commodities traded are illegal (Sellin, 1963, p.13).” To make a 


business enterprise model work for organised crime the variables used for the (S)OCTA also 


°° 'T. Sellin, ‘Organised Crime as a Business Enterprise‘, Annals of the American Academy of Political and 
Social Science, vol. 347, 1963, pp. 12-19. 
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include aspects which deal with the illegal aspects of crime like ‘use of countermeasures’ or 
‘use of violence’. This approach is complemented by the assumption that criminals are 
rational actors. Combining a business enterprise model with the rational actor model allows 
defining a conceptual framework to explain how the criminal enterprise works. These two 
premises provide a logical framework that enables to fill in conceptual gaps in organised 
crime behaviour by an already well-established body of knowledge in these two areas. 

But can these two basic assumptions really be used to define the needed variables to get a 


better understand of how organised crime works? 


8.3. Organised crime as a rational actor acting business like? 


The equation that the behaviour of organised crime groups equals a general business 
enterprise model is appealing and the fact that legal business and organised crime groups 
have the same overall goal in maximising profit favours such comparison. Still, organised 
crime is rooted in considerably different context. The first known organised crime groups 
were mafia-type groups. In this context, mafia-type is used as an umbrella definition for 
groups that follow very distinct rules and procedures, making them insulated groups that can 
hardly be penetrated from outsiders. Mafia-type is not exclusively referring to the traditional 
Italian Mafia. For the ease of the argument mafia-type includes also traditional Russian 
organised crime groups (e.g. Vorovskoy Mir) and traditional Chinese organised crime groups 
(e.g. Yakuza, Triads) and other organised crime groups which are also defined by a strong 
ethnical cohesion. Current national threat assessments available from EU Member States still 
refer to these mafia-type organised crime groups as playing an important in the organised 
crime landscape, even if these traditional organised crime groups have been complemented 
by multi-ethnic, non-hierarchical, fluent organised crime structures acting mainly on 
opportunities independent from a specific crime type. To stick to the business enterprise 
model it would be easy to add the attribute ‘family’ to the business enterprise model when 
referring to mafia-type organised crime groups. By doing so the conceptual model could still 
be maintained for mafia-type organised crime groups. However, existing research into these 
groups shows that the origin of all of these groups goes beyond the family-business concept. 
These groups are based on extreme secrecy, extensive procedures to become a recognised 
member of such an organisation, the overarching principles of absolute obedience, 


confidentiality, and trust. These groups did not come into existence as an alternative model to 
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existing business or family-business structures, these groups developed as a sub-culture 


within an existing society.” 


Another example illustrating the skewed ‘similarities’ between the business enterprise model 
and organised crime can be found when focusing on Outlaw Motorcycle Gangs (OMG). 
OMGs might do not come immediately to mind when talking about organised crime, 
especially as these groups do have different reputations in different countries. Although 
OMGs in the UK are under investigation for alleged organised crime activities a member of 
the Hells Angels participated in the Queen’s golden jubilee celebrations in 2002. 

This illustrates a certain contradiction between the actual criminal activities of OMGs and 
public perception. In Germany OMGs are closely linked to organised crime. A little over 
10% of all organised crime investigations were associated with the criminal activities of 
OMGs. In 2012 the Bundeskriminalamt noted in its annual organised crime situation report 
that ‘with regard to organised crime committed by Germans OMGs play a significant role 
and their involvement has been on the increase’. From this perspective it would be negligent 
not to consider OMGs when looking at the business enterprise model as an explanatory 
working model for organised crime. Becoming a member of an OMG is not a straight 
forward activity. The trajectory to full membership in an OMG has several phases and lasts 
over many years. As the ‘Hells Angels’ are one of the best known OMGs the following 
outline briefly describes the process for becoming a member of this group. The potential 
member goes through different phases and needs to earn his credentials to get closer to be 
accepted as ‘Full Member’. The starting point would be a “‘Hang-Around’, a status that allows 
a prospective member to attend some of the club events; next the potential member becomes 
an ‘Associate’, if actual members take an interest in the ‘Hang-Around’; reaching the 
‘Prospect’ status is the following step (This status includes the full-acknowledgement that an 
individual is in the process of being considered to become a ‘Full Member’. The individual 
concerned may participate in club activities but is not entitled to club voting privileges.); 

at the end the individual will be a ‘Full member’ or ‘Full-patch’. Full-Patch, or being patched 
refers to the fact that the member now has the right to wear all the sanctioned jacket patches, 
including amongst others the Hells Angel ‘death head’ logo as well as the words ‘Hells 
Angels’ on the top patch panel. 


°° For a detailed description see: K. Barksby, Constructing criminals: the creation of identity within criminal 
mafias, Keele University, 2013 
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The mafia-type and the OMG example put a question mark behind the business enterprise 
model as a fitting explanatory working model to understand and describe the mechanisms 
applicable to the activities of organised crime groups. There is no doubt that over the years 
traditional organised crime groups have been complemented by other forms of organised 
crime groups that show a behaviour where it is easier to draw parallels to the business 
enterprise model but this model is not universally applicable when trying to understand 
organised crime. Even for the more business like organised crime groups it cannot be ignored 
that these groups do act in a criminal environment. The link to the non-criminal environment 
is only made when there is a need to launder criminal proceeds to get these proceeds into the 
legal economic cycle to be able to use the money without running the risk to have the money 
confiscated due to its illegal origin. The (S)OCTA indicates that the use of legal services and 
legal business structures plays a crucial role in this process. However, this process only 
reflects one facet of the criminal activities involved. For this process the basic analogy 
stemming from the business enterprise model, the assumption that also organised crime 
groups act rational, is valid. The business enterprise model has gained importance over the 
years to explain the activities of organised crime groups. According to Teece (2010) ‘the 
essence of a business model is that it defines the manner by which the business enterprise 
delivers value to customers, entices customers to pay for value, and converts those payments 
to profit: it thus reflects management’s hypothesis about what customers want, how they want 
it, and how an enterprise can organise to best meet those needs, get paid for doing so, and 
make a profit’ >“ The development of this business model is based on the rational choice 
theory which revolves around the idea that human behaviour is guided by an individual’s 
interpretation of what is in his best interest. Rational choice theory supposes that every 
individual evaluates his/her behaviour by that behaviour’s worth, which is the result of the 


calculation of rewards minus costs.” 


The business enterprise model will work where the partners involved, especially the service 
provider and the customer buying the service have equal rights. Within the context of 
organised crime the service provider would be the organised crime group and the customer 
would be the victim. It is difficult to assume that there is an equal relationship between the 


organised crime group and the victim. 


* D.J. Teece, ‘Business Models, Business Strategy and Innovation’, Long Range Planning, vol. 43, no. 2-3, 
2010, p. 174 
J. Elster, Rational choice. New York University Press, 1986 
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This is exactly the nature of organised crime: there is someone who will have to pay the bill 
against his or her will. Where organised crime is involved there will be an aggrieved party. 
‘Customer care’ is limited to not destroying the illegal market in which an organised crime 
group is making its profit. In addition, the validity of business enterprise models based on 
rational choice in a postmodern society might have to be questioned entirely. Analysing the 
collapse of the Lehman Brothers in 2008 provides an indication that even in legal business 
structures the rational choice assumption could be short-lived nowadays, not entirely refuting 
the rational choice model but making the rational choice model just one of several possible 
models that might be as valid to explain organised crime.”° Although these arguments 
question the value of using the enterprise business model as a model to explain organised 
crime it would be going too far to resort to the opposite assumption and to treat organised 
crime groups and their behavioural pattern as entirely non-rational. Yet, there needs to be a 
more distinct approach which takes into account that it will be a dead-end to solely trying to 


understand organised crime groups by referring to the business enterprise model. 


There is still the need ‘to understand’ how organised crime groups work. Only 
‘understanding’ will provide the tools necessary to develop effective and efficient counter- 
strategies which can be transformed into operational success. Of course, there is also another 
option to tackle organised crime by simply investigating and analysing reported crimes in line 
with the respective provisions in a national penal code. Reality demonstrates that this 
approach which has dominated the law enforcement world for many decades (and still does) 
is not addressing all dimensions necessary for the strategic problem-solving puzzle. 

The development of the drugs market serves to illustrate the case. For decades the ‘fight 
against the illegal drugs market’ has been priority number one for law enforcement not only 
in Europe but around the globe. The report ‘War on Drugs’ by the Global Commission on 
Drug Policy published in June 2011 paints a very sobering picture of the successes 
achieved.’ The report shows the following figures in relation to the worldwide consumption 
of opiates, cocaine, and cannabis based on the United Nations estimates of annual drug 
consumption 1998 to 2008. The consumption of opiates increased from 12.9 million to 

17.35 million, a plus of 34,5%; Cocaine from 13.4 million 17 million, a plus of 27%; and 


cannabis from 147.4 million to 160 million, a plus of 8,5%. 


For further details regarding the unfolding of the Lehman Brothers Crisis see: “The origins of the financial 
crisis - crash course’, The Economist, September 2013 

The Global Commission on Drug Policy, War on Drugs, http://www.globalcommissionondrugs.org/reports/, 
2014, viewed on 15 March 2014 
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In October 2013 the British Medical Journal Open published a report that concludes that 
global efforts to combat illegal drugs have failed to curb supply based on a review of drug 


: 58 
surveillance databases. 


According to the authors, the average inflation-adjusted prices of heroin, cocaine and 
cannabis in the United States decreased by 81% (opiates), 80% (cocaine) and 86% (cannabis) 
between 1990 and 2007. At the same time, their average purity increased by 60%, 11%, 

and 161% respectively. Similar trends were observed in Europe, where the price of opiates 
and cocaine decreased by 74% and 51% respectively during the same period. According to 
the United Nations World Drug Report 2013 the inflation adjusted retail price for one gram 
of cocaine fell from EUR 150,00 in 1990 to EUR 62,00 in 2011, and the inflation adjusted 
retail price for one gram of heroine fell from EUR 136,00 to EUR 52,00. These details do not 
really encourage a positive view when it comes to evaluating the success of the 
aforementioned law enforcement efforts to win the fight against illegal drugs. The statement 
by the Global Commission on Drug Policy “the war on drugs has failed’ does not seem to be 
too far-fetched. Returning to the starting point, investigating the illegal drugs trade does not 
result in the promised success. A more strategic approach focusing on understanding the 
organised crime group and the criminal market can offer a different perspective for tackling 


organised crime groups and criminal markets. 


It is difficult to see that anyone would start to repair an engine or a computer if there was not 
an understanding about how the engine or the computer works. In the same line of thinking it 
is also difficult to see that anyone will be able to find the appropriate means to tackle 
organised crime groups or criminal markets without a basic understanding about how these 
groups and markets work. The need for a strategic perspective is back, even if the paradigm 
might be different. Therefore, the initial methodology chosen by the OCTA/SOCTA and by 
the ECIM is a step in this direction. Organised crime groups and the related criminal markets 
are a difficult subject to research, too many variables cannot be observed directly and it is 
difficult to obtain independent confirmation if the chosen variables are valid and reliable. 
Thus, the usefulness of these variables is something that has to be continuously challenged 


and the variables need to be adjusted in line with the outcome of these critical reflections. 


8D. Werb et al, ‘The temporal relationship between drug supply indicators: an audit of international 
government surveillance systems’, The British Medical Journal Open, 2013, 
http://bmjopen.bmj.com/content/3/9/e003077.full_pdf+html, viewed on 16 May 2015 
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It would be a strength of the ECIM to state clearly that the variables used for data collection 
are not a tablet of stone - a tribute to be made when trying to perform a complex task in a 


society leaning more towards the postmodern angle. 


8.4 The volume of law enforcement data available to the ECIM 


The ECIM offers a new approach for tackling trans-national organised crime, emphasising 
the need to rely more on the intelligence component as the qualifying attribute within 
available law enforcement information. The possible difficulties with regard to relying on the 
intelligence concept which still is not undisputed within law enforcement have already been 
reflected upon. The following chapter will highlight another aspect in relation to the 
information/intelligence used for ‘feeding’ the ECIM - data completeness. Processing data 
provided by 28 Member States offers a plethora of information, even to the extent that the 
available information becomes difficult to handle. However, such information overload can 
be deceptive. Quantity does not replace quality, especially not where information is used for 
strategic purposes. There is a danger that the amount of available data blurs the view 
regarding its quality. Especially in trans-national law enforcement this danger is apparent. 
Joining forces beyond national level to tackle organised crime has for one not a too long 
tradition and second is still flawed by the fact that initiating criminal investigations remains 
within the legal framework set-out by national legislation. The shift promoted by the ECIM 
to divert from information to intelligence could result in overlooking these challenges, 
which could lead to a skewed ECIM not reflecting the actual purpose the ECIM was initially 
developed for. 


Information/intelligence available to law enforcement is generated from either criminal 
investigations, which provide the necessary legal framework for the collection of such data or 
where the legal framework provides for such an option from the pre-investigation phase. 

The mechanism is straight forward. Law enforcement agencies will only be able to pursue a 
criminal case if facts are available indicating unlawful behaviour. However, there is a long 
process involved from suspicion to prosecution and conviction which influences this data. 


1.59 


In criminological terms this is referred to as the funnel model.” The funnel model describes 


the process from reported cases to final conviction. 


°° ~~. Eglin and S. Hester, A Sociology of Crime, London: Routledge, 1992 
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As mentioned before, the German crime statistics of 2011 make reference to around 6 million 
crimes with a total of 2.2 million individual suspects identified, with 2.1 million suspects 
being older than 14 years of age. Going through the investigation funnel only 42.000 of the 
convicted suspects were finally servicing a prison sentence. This means that from the initially 
identified number of suspects only 2 percent were convicted. With regard to the number of 
suspects identified and those that were subject to a court case the percentage moves up to 
almost 39%. Available data from the German crime statistics between 1993 and 2011 show 
that these figures have been rather stable.°' These figures indicate that only information from 
investigations related to 20% of the suspects identified reached the stage of formal judicial 
proceedings. These figures refer to all forms of reported crime. With regard to organised 
crime these figures might represent different ratios. Reporting crime generally depends on a 
victim, but not every victim reports a crime to the responsible law enforcement agencies. 
Crimes committed and not reported are referred to as ‘dark figures’. Although researching 
dark-figure crime is receiving more attention, reliable results are hard to find. The best 
estimates range between a 1:1 ratio for aggravated theft and a 1:8 ratio for simple theft or 
bodily assault.” Existing results of dark-figure research indicate that the overall number of 
crimes committed is at least twice the number of crimes reported. As outlined, organised 
crime in many cases remains (a) victimless or (b) has victims who for a variety of reasons 
have no interest in reporting these crimes to any authority. Therefore, it does not seem 
unlikely that dark figures related to organised crime are even higher than those for ‘ordinary 
crimes’. Reflecting on organised crime related figures made available in the ‘German 
National Organised Crime Report 2013’ shows that there was a total of around 

10.000 suspects identified. Unfortunately, no further information is provided with regard to 
the outcome of any of the organised crime related investigations. Hence, it is difficult to 
estimate if this figure related to the 2.2 million identified mentioned in the National Crime 
Statistics or if the figure is the equivalent to the 850.000 suspects who became subject to a 
criminal investigation that was followed by a formal judicial proceeding. Both options are not 
promising with regard to the data made available for the ECIM. Given the first case this 
would refer to a figure of around 2000 suspects, representing just 20% of the initial figure of 


identified suspects that would be further investigated. 


60 


In Germany the minimum age to have criminal responsibility in front of a court is 14 years of age. 
61 


Polizeiliche Kriminalstatistik 2011, p. 17, published by the Ministry of Interior (German National Crime 
Statistics 2011) 
° Dunkelfeldforschung in Bochum 1986/87’, BKA Forschungsreihe 
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In the latter, the figure would refer to 25.000 identified suspects, representing 39% of this 


figure which equals the 10.000 suspects mentioned in the German Organised Crime Report. 


For the ECIM, group related figures are more relevant, even when the actual criminal 
investigation is directed against individuals. Taking that perspective into account the German 
Organised Crime Report offers the following figures: on average, looking at the figures from 
2004 to 2103 there are on the average 600 organised crime group related investigations per 
year. Applying the above mentioned percentages this refers to roughly 1540 organised crime 
groups being active, of which 600 come under further investigation (39%). Doing the maths 
for all 28 EU Member States these numbers become enormous and there is no reason to 
believe that the situation in Germany is not representative for the EU. Although there are 
many historical, cultural, and political differences within the EU, the distribution of organised 
crime groups should be similar; especially taking into account the EU represents a common 
political and geographical area, with no internal borders. If there is a relation between the 
population and the organised crime groups active in a country the overall figure for the EU 
would be around 8500 active organised crime groups with roughly 3300 of these groups 
being subject to a criminal investigation (39%). Knowing that organised crime groups being 
trans-national in their activities it is obvious that several of these groups will be under 
investigation in different Member States. The question is: Do Member States know that there 
are ‘complementary’ investigations in other countries? Without having respective research in 
this area an experience from Germany can shed some light on this question. In 1997 when 
working at the Bundeskriminalamt as strategic analyst we wanted to know to which extent 
information about ongoing activities by organised crime groups was exchanged between the 
16 federal states in Germany. Here it needs to be understood that the internal federal set-up in 
Germany bears quite some similarity with the set-up of the EU. Regarding law enforcement 
the 16 federal states are acting autonomous with the Bundeskriminalamt acting as a federal 
umbrella, being largely dependent on the will to cooperate from the individual federal states. 
The current concept of the relationship between Europol and the Member States works within 
the same paradigm. To research the existing knowledge transfer it was decided to map 
investigations related to drugs trafficking attributed to the so-called Cali-Cartel, at that time 
the most influential Columbian based organised crime group in Germany. Out of 16 federal 
states 7 had investigations running that were targeting the Cali-Cartel. Even with the 
reunification of Germany in 1990 it was unlikely that in 1997 the Cali-Cartel had already 


expanded to the 5 new federal states, respectively it was still unlikely that the new federal 
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states would have the professional capacity to investigate the Cali-Cartel. This means that the 
criminal structures of the Cali-Cartel were ‘well-established’ in the West Germany with 7 out 
of 11 federal states affected. Although the German Organised Crime Report refers to the 
average group size of an organised crime group being 16 the researched Cali-Cartel in 1997 
included between 35 to 70 suspects, of which only a limited number of individuals became 
subject to formal judicial proceedings. The results of the research were striking. It turned out 
that all investigations were linked by at least one individual. However, the quality attributed 
to these ‘linking individuals’ in the respective investigations at federal state level varied 
greatly. The common denominator was that ‘linking individuals’ were assigned different 
roles across the different investigations. Knowledge about these individuals being part of an 
investigation in another federal state was limited or none existing. It was difficult to provide 
an explanation for these findings. However, the following possibilities were considered: 

(a) input of personal details into existing data databases was limited/not consistent; 

(b) the ‘quality’ of the ‘linking individuals’ was underestimated and therefore the ‘linking 
individual’ was not considered relevant for the actual investigation; (c) the ‘linking 
individual’ was not identified as the main link between the investigations and due to the 
different foci of the investigations the role of the ‘linking individual’ was not further analysed 
or (d) there was no interest by the investigating unit to explore the link to other 
investigations. Whatever the reasons, the example shows the difficulty of taking a wider 
perspective in an investigation if the investigating team is has to focus the inquiry on specific 


criminal offences committed by specific individuals as defined in the penal code. 


The driving force to focus on certain individuals is based on the likelihood of a possible 
conviction in a court case. This was the result of a non-investigative driven analysis at 
national level.®? How the outcome of such research would look at trans-national level 
remains a speculation but respective results could look pretty similar. Own experience at 
Europol supports this statement. Even in very sensitive terrorism-related investigations 
Member States are often not aware to which extent these investigations are potentially 
interlinked to other investigations or different groups of individuals not currently in the focus. 
If such behaviour can still be observed in counter-terrorism investigations where the trans- 
national exchange of information and intelligence is crucial the situation related to organised 


crime related investigations might even be worse. 


° Additional analysis regarding the choice of an individual to become the subject of a criminal investigation 
can be found on page 81 of this thesis. 
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In the end, it does not really matter. The figures and the examples just show that there are 
large dark figures or unexploited areas in criminal investigations, which from an intelligence 
perspective might provide a much more valuable insight into the phenomenon of organised 
crime compared to the information that can be drawn from the reported and investigated 
crimes. The ECIM collects, processes and analyses information/intelligence from 28 Member 
States, facing the challenge that just the available volume of data might be deceptive with too 
much data but not the right data. The reference to the crime statistics highlights another 
challenge. Information/Intelligence to be useful needs to be complete, accurate and up-to- 


date. 


8.5 The criminal investigation is an artificial abstract of the criminal 


reality 


A criminal investigation is the means to investigate a crime, to identify a suspect and to 
finally prepare the court case. It is a factual based exercise. By definition, the findings 
derived from represent the basic input for an intelligence model. Criminal investigations 
provide a huge amount of information that cannot be obtained from any other source. 

Perhaps even more important is information that can be gathered from investigations which 
did not find their way into a court or were dropped by the investigators in agreement with the 
prosecution service half way through the investigation phase. Only a reported or known crime 
triggers a criminal investigation.” However, the more complex an investigation the more 
likely it is that the criminal activity will be chopped into bits and pieces due to the fact that 


these activities need to be subsumed under the existing national penal code in court. 


This re-shaping results in certain criminal activities to be prosecuted as available evidence 
allows for such a prosecution. Other activities may be excluded from further prosecution 
because evidence is not available or too difficult to be obtained to prove a crime, or simply 
because the activity as such does not constitute a crime in the true sense of the word 

(e.g. if drugs are seized on a ship and the actual involvement of the Reeder is unknown, the 


initial acquisition of the ship does not play a role in the criminal proceedings, 


* The need for a strategic document to be based on up-to-date information and the need for data to be accurate 


refers to the basic data collections requirements focusing on behavioural patterns as outlined on p. 47 et seq. 
of this thesis. 

Within the EU Member States this concept is not universally applied. There are Member States that work on 
the concept of a mandatory prosecution of crime whereas others apply the principle of opportunity. 


65 


Page 79 of 146 


although this process might be of utmost importance from an intelligence perspective 
regarding the understanding of the criminal activity as a whole). What happens when a crime 
is investigated is some kind of artificial compartmentalization. In addition, available data 
related to the administrative framework of criminal investigations contain useful information 
for an intelligence model: the number of investigators used, the length of the investigation, 
the actual charges compared to the initial charges, the number of suspects finally prosecuted, 
the conviction rate, the average length of the sentences for certain crimes, the requests for 
appeal, the actual profit made compared to the confiscation of assets, etc. All this information 
needs to be included in a revised intelligence model, as the interpretation of this data will 
enable law enforcement to fine-tune future counter-strategies to be more successful. 

Limiting data collection to the criminal act only provides half the picture as such a 
perspective does not consider how law enforcement agencies by performing or not 


performing considerably influence available data as the basics for the intelligence function. 


The proposed revised ‘3-iModel’ not only adds complexity to the concept of intelligence led 
policing.” The new model also illustrates that intelligence as a core ingredient of the model 
does not exclusively consider intelligence derived from the criminal environment. Therefore, 
the initial question if the ECIM is referring to criminal-intelligence or to intelligence used in 
a crime-related context is an issue. If the latter is intended then an ECIM has to be based on 
the revised 3-i-Model. The initial 3-i-Model does not provide a comprehensive conceptual 
model to accommodate today’s law enforcement strategic needs in a more complex reality. 
However, it might be doubtful to which extent such a revised model can be implemented at 
EU-level, taking into account that even the basic 3-i-Model is still far from being universally 
accepted and implemented in the law enforcement community across Member States. 

This challenge is discussed further within this thesis and should not be used as an excuse to 
limit the actual scope of the envisaged ECIM. For this reason it is suggested that for a 
European Criminal Intelligence Model no hyphen is used between criminal and intelligence 
to avoid limiting the scope of such a model. At first sight expanding the concept of 
intelligence beyond the criminal context of the model might be overambitious, which could 
lead to an unwanted early failure of the model. Nevertheless, the further discussions 
demonstrate that an ECIM will only be successful if such a broad perspective is chosen. 


A more limited scope will only lead to ‘running around in circles’. 


°° As outlined in chapter 6 of this thesis. 
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8.5.1 Different perspectives when evaluating investigations from a national, 


operational or a trans-national, strategic perspective 


The rationale of the European Criminal Intelligence-Model is based on the fact that it is well 
understood that certain crime phenomena are common across Member States. It is equally 
understood that this requires a focused trans-national approach due to the scale, significance 
and negative impact of these crimes.°’ There are obvious crime areas which will show up as 
the ‘usual suspects’, like drugs trafficking, trafficking in human beings, facilitating illegal 
immigration, money laundering, and cybercrime. But it also obvious that a changing 
environment, not only the criminal environment also creates new forms of crime which 
currently are not on the radar or are regarded as low priority. It can be argued that 

(a) there is no need for a new mechanism at EU level to address these new developments as 
the most important crime areas are well known and have been on the priority list of Member 
States for several years already and it is unlikely that the list of ‘usual suspects’ will 
considerably change over the next years to come; and (b) new trends have always been there 
and have been picked up by the law enforcement community once these trends have really 
manifested themselves as a phenomenon that requires the respective attention. Cybercrime 
being one of the striking examples over the last decade which has managed to get into the list 
of ‘usual suspects’ and might even have managed to be on top of the list by now. Therefore, it 
might not be necessary to have a different early-warning-system in place which indicates that 
there is already a self-regulatory mechanism within the law enforcement community that 
guarantees that priorities will be re-adjusted once the magnitude of the crime phenomenon 
has been established. In addition, the European Union has already provided the necessary 
tools to tackle these problems effectively if an orchestrated trans-national response is 
required. These tools can mainly be found in a variety of different decisions taken by the EU 
(e.g. the Schengen Acquis, the Priim Treaty, the legal framework for setting up Joint 
Investigations Teams, or the so-called Swedish Initiative). This sounds reasonable. 
Unfortunately this perspective mirrors the wishful-thinking of law enforcement rather than 


reality. 


°7 Tn this context it does not matter if these consequences are described as harm, damage, or impact. There 
should be agreement that any consequence has an unwanted negative effect on society, which constitutes the 
common denominator. 
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The fact that police or law enforcement agencies are resistant to change has been researched 
widely. For example Cope (2004) emphasizes that police culture is likely to represent a 
serious obstacle to implementing a new model of policing.™ This specific police culture is 
easy to be explained as the police in the concept of the nation state have been assigned a 
specific role as already mentioned in the previous chapter. This role remained unchallenged 
for decades and was further strengthened by a modern approach enforcing a ‘grande- 
narrative’. The grand-narrative puts law enforcement into a unique position as the guardian of 
society and the upholder of basic universal societal values. The role of law enforcement has 
been inviolable for decades and there was no discourse if the police was possibly in the 
wrong. This in return had an impact on the self-conception of the police, which can be 
summarized by stating that the police had the tendency to be sure to have all the answers to 
all the questions and that there was no need to adapt to a changing environment as the police 
response would still be valid. To a certain extent this sounds re-assuring as it provides at least 
a constant in a time which mainly is characterized by change. Having said this, the possible 
change from a modern society in which these arguments make sense to a postmodern society 
where these arguments do not hold or are even to be considered anachronistic might distort 
such a perspective. Already the initial findings in the first 2006 OCTA contradict this 
perspective and so does the latest SOCTA 2013. Of course, also the 2006 OCTA resorts to 
the ‘usual suspects’. However, the 2006 OCTA tries to look at the ‘usual suspects’ from a 
different perspective. That crime is evolving is a natural process. The analytical perspective 
of the 2006 OCTA tried to answer the question if there were major differences in the set-up 
of organised crime groups, which made them also different with regard to the strategy law 
enforcement would have to deploy to successfully tackle these groups according to these 
differences, if they exist. In line with the argument made above the first assumption would be 
that organised crime group do mainly differ with regard to their nationality mix, the crimes 
they are focusing on, and the geographical influence they would have. So far, the traditional 
concept. The 2006 OCTA showed differences in areas that did not fall into the 
aforementioned categories and which until this point in time were not considered when 


developing law enforcement counter-strategies. 


8 N. Cope, ‘Intelligence led policing or policing led intelligence?’, The British Journal of Criminology, 
vol. 44, no. 2, 2004, pp. 188-203. 
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Strategic analysis of available non-law-enforcement data can lead to different priorities 
compared to those traditional law enforcement at national level has been comfortable with. A 
good example in this context can be found in the 2011 OCTA. The report mentions missing- 
trader-intra-community-fraud (MTIC) as generating multi-billion Euro losses to EU Member 
States each year. A couple of years earlier, a reference to this type of crime was nowhere to 
be found. Law enforcement agencies in Member States did not have had a single 
investigation into the subject matter, at least not within the reporting mechanism to the 
OCTA. Instead, traditional forms of organised crime (drugs, illegal immigration, trafficking 
in human being, counterfeiting the Euro and other counterfeits) were the only types of 
investigations that were reported to the OCTA. Empowering European Agencies to 
investigate into crime areas from a European rather than a national perspective has changed 
the landscape of crime. Other non-traditional crime areas are prioritised due to new mandates 
that do not focus on a national Member State’s perspective and the actual information needed 
to further investigate new priority areas like MTIC fraud is not available within the traditional 


concept of policing. 


The 2006 OCTA covers known territory when it comes to describing the organised crime 
environment in the EU by taking a traditional approach regarding the ethnic origin of the 
criminal groups and their criminal activities. Nevertheless, the chapter ‘The threat from 
organised crime’ enters new territory. Here the 2006 OCTA starts to deconstruct organised 
crime groups into their individual components. Components which evaluated individually 
and then combined define the threat level of the group. In this context the first two criteria, 
‘international dimension’ and “group structure’ are of specific interest as these two criteria for 
the first time take a perspective on organised crime groups that is more leaning towards a 
social science like approach. These two criteria start to interpret the behaviour of an 
organised crime group as a single entity. International dimension is defined as “the 
international dimension of OC can be captured as international co-operation, between non- 
indigenous groups or between an indigenous and a non-indigenous group, or as international 
operations carried out directly by an OC group’. The chapter dwells further into this concept 
and adds aspects related to where the actual ‘strategic level members’ are physically based 
(e.g. inside or outside the European Union) and how organised crime groups secure their 
assets. The next section discusses group structure stating that ‘the existence of criminal 
organisations or networks should not be taken for granted; attention should instead be paid 


on the conditions under which patterns of criminal association and co-offending emerge and 
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exist’. In retro-perspective and taking into account the self-perception of modern law 
enforcement as described before it is not surprising that the first OCTA was met with huge 


scepticism by law enforcement agencies in Member States. 


8.5.2 The need to operationalise strategic findings 


Before the OCTA the law enforcement community was used to be confronted with similar 
amorphous approaches stemming from the academia, which was mainly recognised as 
another social science based perspective on organised crime without practical implications. 
Now, for the first time such an approach is coming from within. A strategic analysis 
originating from Europol, the European Police Headquarters, bringing new typologies of 
organised crime groups into play which were far from the traditional concept of ‘law 
enforcement agency A in country B is investigating the members of an organised crime group 
for illegally smuggling and distributing commodity C based on crimes committed and 
potential offenders identified’. The reaction from those focusing on operational activities was 
simply to declare these initial OCTA findings to be useless in an operational context as these 
findings did not support a criminal investigation in any way. Unless there is no link between 
strategic direction and operational activity this is the wrong conclusion. It is undoubted that 
‘there is enough organised crime ‘around’ for law enforcement agencies in Member States to 
have the luxury to decide which investigations are run and which are not due to limited 
resources. This puts an emphasis on the need to choose the right operational activities. It also 
has led law enforcement agencies to a ‘dangerous’ selection process of these investigations. 
If there are enough potential investigations to choose from it is tempting to concentrate on 
those investigations which will produce the ‘best results’ (e.g. amount/value of commodities 
seized, likely conviction rate). There is nothing wrong if these investigations also tackle those 
organised crimes groups that represent the greatest threat, at least at national level. 

That is where the problem starts. Such an evaluation can only be made if there is a strategic 
assessment which identifies those organised crime groups or crime areas that constitute the 
greatest threat from a holistic perspective. Law enforcement agencies have to ask themselves 
more often “Does law enforcement do things right or is law enforcement doing the right 
thing?’ Strategic analysis offers the answer, especially as strategic analysis is not 
immediately result driven in contrast to operational activities. Strategic analysis cannot only 
afford to take a step back from being directly involved in investigative activities it is the pre- 


requisite for the strategic perspective. 


Page 84 of 146 


However, strategic findings are not always welcome as the findings might identify crime 
areas that so far have not scored high in the operational success story ratings or require a re- 
thinking in how to effectively tackle a specific organised crime group. Both options do not 
neatly fit into a law enforcement environment which is shaped by a general resistance to 


change and a focus on immediate operational success. 


To illustrate the need for the close relationship between operational activities and strategic 
findings the 2006 OCTA again serves as an example. The report identifies organised crime 
groups to be distinguished with regard to where these groups keep their assets. Available 
options for law enforcement to seize such assets are fundamentally difference if assets are 
kept inside or outside EU jurisdiction. For years, in criminal investigations, including 
investigations into organised crime, the component of financial investigations was not very 
high on the agenda. The reason for financial investigations being neglected was simple: 

A detective is not an accountant; a detective tackles crime and brings criminals behind bars. 
With recognising the existence of organised crime this perspective slowly changed. 

Money laundering legislation including suspicious transactions became an important tool in 
tackling organised crime and financial investigation units were becoming part of every re- 
organisation that took place when modernising law enforcement organisations. It has been 
said before that law enforcement prefers to act in a comfort zone. Once financial 
investigations were established as the appropriate means to be successful in investigating 
organised crime groups it became an automatism to include a financial component into each 
organised crime investigation or to have the investigation even be led by the financial 
investigation team. Financial investigations became a Pavlov reaction in relation to organised 
crime. When the 2006 OCTA introduced a new perspective on how organised crime groups 
are organised the meanwhile established routine was disturbed. The automatic link between 
the activities of an organised crime groups and the necessity to focus on financial 
investigations was not so obvious anymore. Due to different behavioural patterns there was 
now a need to actually try to understand in which typology a certain organised crime group 
would fit to decide to which extent financial investigations would provide the necessary 
evidence to have a successful investigation. As academic as the strategic finding in the 2006 
OCTA seemed, taking a second look shows that the strategic assessment has added a new 
dimension into the discussion on what makes an investigation into an organised crime group 


effective. At the same time it needs to be highlighted that these strategic findings would need 
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further research to evaluate their actual validity. Nevertheless, there are sufficient indicators 


in the available data to draw such an initial conclusion. 


Discarding the 2006 OCTA as not being operationable misses the point. To accept that a 
strategic assessment has its value just because it is a strategic assessment falls short from 
providing the right framework. If it is not possible to translate a strategic assessment into 
operational activity the strategic assessment does not serve its purpose. The link between 
strategy and operational activity has to run both ways. However, there is still some way to go 
to convince the law enforcement community, used to be mainly measured by operational 
success, to recognise the value of strategic assessments as the appropriate guide to direct 
operational activities, especially when the strategic assessments challenges the actual value of 


an established law enforcement comfort zone. 


Moving to the findings of the current 2013 OCTA again shakes the assumption that law 
enforcement agencies will be effective if they continue to follow old patterns dominated by 
operational success. With regard to organised crime groups the report mentions that there are 
currently 3.600 international organised crime groups active in the EU. This number is the 
sum of organised crime groups reported upon by 27 Member States, which means that there 
has already been a selection at national level with regard to the groups that would be subject 
to the national OCTA contribution and which would not. Looking at the actual definition for 
organised crime groups to be relevant for the OCTA it is obvious that the number of reported 
organised crime groups for the 2013 OCTA only represents a fraction of the overall number 
of organised crime groups law enforcement communities in Member States have ‘to handle’. 
The respective calculations were made with regard to the extrapolation of dark figure data on 
p. 56 et seq. of this thesis. In this context it is irrelevant if reference is made to 
Enfopol35/1997 or the more flexible definition used with the introduction of the OCTA in 
2005. Analysing quantitative data is not the prime strength of a strategic assessment. 


This explains that the major part of the 2013 OCTA is dedicated to qualitative analysis. 


Nevertheless, a reflection on available quantitative data is sufficient to demonstrate the need 
for strategic guidance beyond the national perspective. 3.600 organised crime groups qualify 
for the OCTA based on their international dimension, indicating that the activities of these 
groups are not limited to one specific Member State only. Which activities do constitute the 
‘international dimension’ is not entirely clear. The 2006 OCTA outlined that ‘international 
dimension’ can be attributed to a variety of different characteristics. To tackle these organised 


crime groups effectively cross-border cooperation between different law enforcement 
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agencies is a prerequisite but law enforcement resources are finite and finite resources have to 


be deployed carefully to achieve best results. 


This leads to very simple questions: Which of these 3.600 organised crime groups are to be 
tackled first? Who takes the lead in tackling the respective group? Which offences should be 
prioritised? Which resources by whom are required to tackle the group successfully? How do 
these groups compete with other organised crime group that were not reported upon from a 
national perspective? Trying to find appropriate answers by continuing the traditional 
national perspective is bound to fail. However, such failure might not be obvious as law 
enforcement agencies will continue to produce successful operational results that will make it 


to the headlines. It is coming back to the question “Are we doing the right things?’ 


To be able to effectively tackle organised crime strategic guidance is needed. Not only to 
orchestrate a trans-national response which will fall into the responsibility of different 
jurisdictions therefore requiring a higher level of coordination but also to take the right 
priority decisions at national level. The ECIM is intended to provide the respective 
framework. Unfortunately, the ECIM alone will not be able to achieve these goals due to the 
role national law enforcement plays in getting this concept to work. This requires a strong 
link between the ECIM and national intelligence models. The ECIM is a cycle build on the 
following components: (a) define priorities areas; (b)identifying knowledge gaps in priority 
areas; (c) develop a data collection plan to fill the identified knowledge gaps, (d) analysing 
newly obtained information; (e) define action plans for prioritised areas; (f) Member States 
target organised crime groups in line with identified priority areas; (g) information/ 
intelligence obtained from Member States investigations is fed into the data collection phase 


for the new (S)OCTA (h) the EU decides on strategic priorities based on the new (S)OCTA: 


The Informed by the OCTA 
Council sets strategic priorities 


ECIM: 
s 
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What looks nicely like a closed system turns out to be an open one. Identifying knowledge 
gaps in priority areas (b), Member States target organised crime groups in line with identified 
priority areas (f), and information/intelligence obtained from Member States investigations is 
fed into the data collection phase for the new (S)OCTA (g) make the ECIM a Member State 
dependent exercise. As mentioned above, the ECIM only works if Member States internalise 
the concept by investing in a national intelligence model that will serve the requirements of 
the ECIM. In addition, Member States will be required to align their investigative efforts with 


the findings stemming from the ECIM. 


According to Project Harmony, initiated by the Belgian EU Presidency outlining the 
foundations for turning the ECIM from a theoretical concept into an applied methodology in 
law enforcement across Europe, Member States have several years to develop and to 
implement these steps. The final and full implementation for the ECIM at EU level and 
Member States is foreseen for 2017. 

Project Harmony also foresees in the planning from 2011 to 2017 the development and the 
delivery of training/awareness packages to further support Member States in implementing 
National Intelligence Models and to compile good practices/lessons learned for the 
implementation of Member States’ National Intelligence Models aligned with the ECIM. 

In 2014 Member States were still far from developing such National Intelligence Models. 
The data collection for the (S)OCTA is an obligation which Member States cannot bypass 
due to the commitment expressed at political level in Brussels. Nevertheless, the 
implementation in Member States and at EU level follows different speeds. In an ideal 
situation the speed would have to be synchronised to achieve the expected outcome, in 
particular if the importance of existing regional or local aspects becomes more important in a 


postmodern Europe. 
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8.6 Support of the ECIM by Member States and the ECIM leaning itself 


towards a more postmodern concept 


There are some Member States which have undertaken considerable efforts to streamline 
activities at national level with those at EU level, especially Belgium, the Netherlands, and 
the United Kingdom. These countries were also the main players in bringing project 
Harmony to life. In addition, Denmark and Sweden have closely followed the idea of 
developing a national intelligence model. It could also be observed that Germany has been 
very active in the preparation phase. However, the interest of Germany was to a large extent 
driven by making sure that the new methodologies for the OCTA/SOCTA and the ECIM 
would not divert too much from the existing national framework for producing the German 
National Organised Crime Situation Report (Bundeslagebild Organisierte Kriminalitaet). 
The history of the German ‘Bundeslagebild’ provides an explanation for the caution in the 
German approach. Addressing the phenomena of organised crime from a national and 
strategic perspective goes back for almost 25 years when the first definition of organised 
crime was agreed upon between the German Federal Criminal Police HQ 
(Bundeskriminalamt), the respective representatives from the Regional Criminal Police HQs 
(Landeskriminalaemter), and the German Customs Police HQ (Zollkriminalamt). Having to 
build consensus between the Bundeskriminalamt, the Landeskriminalaemter (11 at that time) 
and the Zollkriminalamt was a major achievement in a state where the federal states 
(Bundeslaender) are almost autonomous when it comes to law enforcement. Ever since 1990 
the Bundeskriminalamt is producing the “‘Bundeslagebild’ based on the aforementioned 
agreement. It is not difficult to understand that even with such an agreement it took the 
Bundeskriminalamt considerable efforts to convince the Landeskriminalaemter (11 before, 


and 15 after reunification) to provide the requested data. 


To a degree the German experience in developing the Bundeslagebild could be compared 
with the implementation efforts of the ECIM discussed in this thesis. From a national German 
perspective, the Bundeslagebild methodology works and there is even some literature 
discussing the possibilities for a European Organised Crime Threat Assessment that refers to 
the methodology of the Bundeslagebild as a potential blue-print.” Over the years, the 
Bundeslagebild has developed from a quantitative/statistical assessment to an assessment that 


also includes qualitative analysis. 


® T. vander Beken, Measuring Organised Crime in Europe, Maklu, 2006 
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The German law enforcement community has incorporated the Bundeslagebild in its annual 
national law enforcement planning cycle with the German Minister of Interior presenting the 
key findings of the Bundeslagebild to the public before the report is officially released. The 
German methodology for the Bundeslagebild being so deeply anchored within a German 
context it is not surprising that the German approach to the OCTA/SOCTA and finally the 
ECIM had to be sceptical as there is no obvious reason to change a winning team’. The 
Bundeslagebild does not really try to provide an understanding of how organised crime 
groups or criminal markets work. Even with the improved qualitative angle the 
Bundeslagebild still focuses on identified facts and figures. Interpreting these findings is not a 
priority. With the OCTA/SOCTA turning towards a more interpretative approach the existing 
Bundeslagebild-methodology would have to be revised considerably. The experience gained 
by the BKA in developing the Bundeslagebild and the resistance met at national level in the 
process was reason enough to try to model the OCTA/SOCTA methodology as close as 
possible to the existing Bundeslagebild-methodology. This example shows the importance for 
the ECIM to be successful to reach out to Member States to make sure that national law 


enforcement perspectives concur with the ECIM or can be streamlined accordingly. 


Operational law enforcement activities are implemented at national level, following national 
interests and a national political agenda. As long as Member States remain sovereign states 
within the European Union this will not change. To further illustrate the discrepancy between 
the European and the national level also the United Kingdom can serve as an example. 

In 2013 the National Crime Agency (NCA) became operational replacing the Serious and 
Organised Crime Agency (SOCA). In the first half of 2005 the United Kingdom had been the 
driving force for the ECIM, just before taking up the Presidency of the European Union. 
Therefore, a strong link would be expected between the SOCA/NCA and the ECIM. 
However, referring to the NCA’s Website leads to a rather disappointing result. There, the 
NCA is described as a ‘crime -fighting agency with national and international reach, 
mandated and empowered to work in partnership with other law enforcement organisations’ . 
Within the NCA the ‘Organised Crime Command’ (OCC) is the most relevant entity for the 
ECIM. Unfortunately, when the work of the OCC is described in more detail not a single 
reference can be found to the European context much less the ECIM. The OCC focuses on 
the national perspective. The OCC even refers to the establishment of strategic oversight of 
individuals and groups utilising Organised Crime Group Mapping, a concept which seems to 


be entirely different from the ECIM methodology. 
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In addition, the OCC bases its work on strategic action plans focusing on five threats: Drugs; 
Firearms; Organised Acquisitive Crime; Organised Immigration Crime and Prisons and 
Lifetime Offender management. The link to the ECIM or the priorities identified by the 
OCTA/SOCTA seems, to put it mildly at least to be fragmented. The German and the UK 
example both illustrate that implementing an ECIM cannot be achieved by simply defining a 
principle road-map and a timeline (project Harmony) which is endorsed by the political 


stakeholders in Brussels 


As the ECIM is intended to be the overarching mechanism for the law enforcement 
community across Europe the number of national law enforcement agencies mentioned 
actively participating in developing the ECIM is rather low in relation to the 28 Member 
States of the European Union. At face value there is a general division between the Northern 
and the Southern hemisphere within the European Union when it comes to the ‘active agents’ 
pushing the ECIM. Germany, already trying to contain the ideas presented in the ECIM in 
line with the existing national approach, is the country the furthest south from a pure 
geographical perspective that has joined the ECIM efforts. There is a need to find a way to 
create a common platform including all Member States. National law enforcement agencies 
remain the stakeholders of operational data that is necessary to be processed and analysed at 
European level to generate strategic findings that can be used to define priorities for law 
enforcement in a trans-national and European setting. At the same time, the authors of the 
OCTA/SOCTA have realised that there are too many differences across Europe to be able to 
provide a consolidated homogeneous European perspective on organised crime groups and 
the priorities in tackling them. At the political level the need for such a diversified 
perspective is not immediately obvious. The Council conclusions on setting the EU’s 
priorities for the fight against organised crime between 2011 and 2013, agreed upon during 


the 3096th Justice and Home Affairs Council meeting in Luxembourg in June 2011 solely 
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talk about general EU priorities.’° The Council conclusions do not reflect the complex 
conceptual model the OCTA has developed to produce a more in-depth and differentiated 
picture of the threats identified. The OCTA does not focus exclusively on a European 


perspective. 


The first OCTA published in 2006 contained an initial reference to the existence of ‘regional 
hubs’ in Europe. Besides the expected priority crime areas like drug trafficking, trafficking in 
human beings and illegal immigration, fraud, counterfeiting, intellectual property theft and 
money laundering the report identified ‘regional patterns’ that have distinct features which 
make it noteworthy to point out their specific ‘peculiarities’ requiring an individual strategic 
approach to counter the particular forms of organised crime revolving around these regional 
centres. The 2007 OCTA not only confirmed these findings, the report further exploits the 
regional hub concept as an important characteristic when analysing the manifestation of 
organised crime in Europe. The importance of regional hubs to take a more diversified 


approach on organised crime in Europe was further developed in the following years. 


The 2007 OCTA recognised that the European Union is not a homogeneous structure, 
especially not for law enforcement, even not from a strategic perspective. A one-size-fits-all 
strategic approach does not work. Different influencing factors identified and present in one 
and absent in another region inevitably leads to different manifestations of organised crime 
therefore requiring a tailored regional strategic approach which takes these differences into 
account. At first sight such a distinction might be contrary to the idea of a European 
Organised Crime Threat Assessment and the ECIM as this distinction results in a more 
scattered European approach, moving away from the idea of streamlining trans-national law 
enforcement activities into a more homogeneous, European-minded perspective. Regarding 


this diversity as contradicting can only be done if looked at from a modern perspective. 


” These priorities read as follows: (1) weaken the capacity of organised crime groups active or based in West 
Africa to traffic cocaine and heroin to and within the EU; (2) mitigate the role of the Western Balkans, as a 
key transit and storage zone for illicit commodities destined for the EU and logistical centre for organised 
crime groups, including Albanian-speaking organised crime groups; (3) weaken the capacity of organised 
crime groups to facilitate illegal immigration to the EU, particularly via southern, south-eastern and eastern 
Europe and notably at the Greek-Turkish border and in crisis areas of the Mediterranean close to North 
Africa; (4) reduce the production and distribution in the EU of synthetic drugs, including new psychoactive 
substances; (5) disrupt the trafficking to the EU, particularly in container form, of illicit commodities, 
including cocaine, heroin, cannabis, counterfeit goods and cigarettes; (6) combat against all forms of 
trafficking in human beings and human smuggling by targeting the organised crime groups conducting such 
criminal activities in particular at the southern, south-western and south-eastern criminal hubs in the EU; (7) 
reduce the general capabilities of mobile (itinerant) organised crime groups to engage in criminal activities; 
(8) step up the fight against cybercrime and the criminal misuse of the internet by organised crime groups. 
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In a postmodern society this diversity would even be welcome. The fact that the concept of 
‘regional hubs’ did not get a prominent role when defining priorities at EU level can be seen 
as another indicator highlighting the difficult situation trans-national law enforcement finds 
itself in: Combining the requirement for an overarching European approach to more 
effectively tackle trans-national organised crime with a reality which requires a more 
individualised approach at regional level. Law enforcement again might be trapped in an 
outdated understanding of having to find that one equation which provides the answer to all 
law enforcement related questions to be able to ‘eradicate’ organised crime once and for all. 
An unrealistic conceptual model, challenged by the aforementioned regionalised OCTA 
findings. Nevertheless, at European level there is still a certain reluctance to address those 


apparently contradicting European-centred and regional-focused models. 


8.7. The ECIM depends on the successful implementation of National 
Intelligence Models in Member States 


It has been said before that the ECIM cycle is not so much as a cycle when it comes to the 
different entities involved in implementing the concept. Strategic findings of the ECIM have 
to be translated into operational activities. In an ideal world the results of translating strategic 
findings into operational activities will confirm the strategic perspective taken. This requires 
that the ECIM is replicated at national level. In project Harmony this is referred to as 
introducing an ECIM-based National Intelligence Model (NIM) in Member States. 

And again, the geographical split between the Northern and the Southern hemisphere of the 
EU comes into play. To provide an explanation why law enforcement approaches are 
different in these two major regions of the EU would be subject for another thesis. 

The approach can be summarised as proactive versus reactive. Crimes are committed and 
need to be investigated and offenders identified in committing these crimes have to be 
brought to justice. Researching cause and effect does not fall into the basic mandate 

of law enforcement; the main mandate of policing is to enforce the law. This has two 
consequences for the OCTA and the ECIM: (a) if analysing cause and effect does not play a 
major role in law enforcement it will be difficult to obtain the necessary information for the 
OCTA as the policing paradigm does not reflect on such information, and (b) if the ECIM 
defines certain priorities that do not correspond to existing priorities it will be difficult or 
almost impossible to direct law enforcement from the existing path. The concept of regional 


hubs as outlined in the 2007 OCTA for the first time becomes even more important, with or 
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without a NIM in place. To get the law enforcement agencies in ‘passive’ Member States to 
buy-in into initiating operational activities based on the ECIM there needs to be an incentive. 
In a conservative, reactive law enforcement set-up this incentive can only be related to 
operational success as success of law enforcement is measured by tangible results, especially 
arrested suspects and seized commodities. Considering this mechanism it becomes obvious 
that any proposed operational activity based on ECIM priorities that does not take into 
account the specific interest of the Member State concerned is doomed to fail. This does not 
mean that the OCTA or the ECIM have to do a backward-roll but it underlines the value of 
the concept of regional hubs as a vital component which will considerably impact on the 


overall acceptance and validity of the ECIM. 


With the new SOCTA methodology the regional hub concept was given up as it was felt that 
the dynamics within organised crime had again taken a different direction. The original 
regional hub concept had become too static, not keeping pace with organised crime that had 
become more fluent and driven by opportunity in an ever changing environment. Even the 
regional perspective might have been too large. Without further evaluating this new approach 
it should be pointed out that what has been written so far in this thesis might question this 
perspective. Organised crime might not be as amorphous as proposed. This does not discard 
the fact that new opportunities for organised crime will be exploited by organised crime 
groups that are able to seize these opportunities. However, there is still a large number of 
traditional organised crime areas around which will continue to be the focus of a large 


number of more traditional organised crime groups. 


The fact that the OCTA/SOCTA has identified the need for a multi-facetted approach when 
taking a strategic perspective with regard to organised crime in Europe is an achievement as 
such which should make the law enforcement community in Member States more 
comfortable with the OCTA/SOCTA. Unfortunately, as the example for the United Kingdom 
demonstrates the existing relationship between law enforcement agencies in Member States 
and the OCTA/SOCTA still is rather alienated. The same is applicable for Germany. A search 
of the Website of the Bundeskriminalamt produces similar results with no reference to the 
OCTA/SOCTA findings to be found. So, where is the OCTA/SOCTA going wrong as even 
Member States that do have a National Intelligence Model in place to not further incorporate 
the findings of the OCTA/SOCTA in their national strategy? The ECIM cycle gets broken up 
when strategic findings are transposed into operational activities. This should happen at 


national level when the ECIM with the help of the OCTA/SOCTA has identified priority 
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areas and top criminal networks. The problem is that the OCTA/SOCTA described so far 
does not allow for the identification of top criminal networks. For the time being, the ECIM 
can be compared to a Management Information System focusing on providing aggregated 
strategic information derived from operational data. '' Such aggregated data cannot be 


attributed to a specific criminal network. 


Data collection for the OCTA/SOCTA is based on non-identifiable data and focuses on 
‘conceptual data’ which enables the ECIM to understand organised crime and the groups 
involved. The ECIM describes the general behaviour of organised crime groups and has 
identified the need to further break down Europe into regional hubs. These findings do not 
themselves translate into operational activities. In addition, it was already stated that the 
relationship between the ECIM and the law enforcement community at Member State level is 
not at its best. In the current situation, the cogs between European and Member State level are 
not properly interlocked. To simply limit the added value of the ECIM to prioritised crime 
areas would not justify the efforts put into developing such a model. Reflecting only on these 
priorities just leads to the question ‘where is the news?’ Taking the actual order aside, these 
priority crime areas are identical to the priority crime areas already identified for years by the 
majority of Member States in their national strategies to tackle organised crime. To be able to 
go beyond these basics and to identify specific organised crime groups posing a concrete 
threat to Member States within the European Union takes the ECIM a step further. 

Still, the question needs to be answered how such findings can be operationalised. The ECIM 
currently does not provide a respective mechanism. The ECIM leaves complete discretion to 
Member States with regard to how the strategic findings are operationalised at national level. 
Nevertheless, due to the large number of organised crime related investigations in Member 
States a steering or selection mechanism needs to be in place to identify those trans-national 
investigations that would really allow obtaining additional information necessary to support 
or refute the premises developed by the OCTA/SOCTA. For the ECIM to be effective in this 
respect data collection requirements have to reach a different level to establish a direct link 
between strategic findings and operational activities. To have these decisions taken only at 
Member State level leaves the risk that law enforcement agencies remain in the trap of 


choosing investigations that fall into the mentioned ‘investigation comfort zone’. 


” The concept of a Management Information System is further elaborated on p.100 et seq. of this thesis. 
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For a strategic function to be effective the strategic function must be independent of such 
thinking and in a position to direct operational activities according to the strategic findings, 
not according to convenience. Directing operational activities does not include an immediate 
involvement at operational level but the underlying decision regarding the actual 
investigation has to be taken based on the strategic assessment. Therefore, besides for the 
ECIM to provide the overall strategic framework for tackling organised crime the ECIM has 
to play an active role in the operational decision making process. This requires including an 
additional layer of data into the process that is closer to identifiable personal data than the 
initial strategic data used within the concept of the ECIM as an information management 


system. 


In the chapter on data protection requirements it is said that the ECIM as such will have no 
need to analyse personal data therefore declaring data protection concerns as outside the 
scope of the current discussions. For the ECIM to be fully functional and to be able to 
operationalise the respective strategic findings at national level this perspective might have to 
be revisited. In the current set-up with only aggregated strategic data the ECIM will be unable 
to identify a specific target. However, due to the described gap between the ECIM and 
operational law enforcement activities at Member State level the identification of specific 
targets is crucial for the success of the ECIM. With the establishment of “behavioural 
patterns’ of organised crime groups the ECIM has to be able to decide which investigations at 
Member State level best match these patterns. To make the model work the ECIM will have 
to include an additional layer or discussion process between the ECIM at European and law 
enforcement at national level. At national level law enforcement agencies need to cross-check 
their investigations against these patterns. These patterns are the result of the strategic 
analysis undertaken at EU level and it cannot be expected that national law enforcement 
agencies take the same perspective. Many of these strategic considerations are not considered 
during the investigation phase - for the right or wrong reasons as explained before. 

Hence, national law enforcement agencies have to assign the respective ‘strategic tags’ to 
their investigations. In addition, the international dimension of the organised crime groups 
involved will have to be elaborated extensively. Although organised crime activities in a 
Member State are committed to a large extent by indigenous organised crime groups acting at 
national level with limited trans-national exposure it is important to focus on those groups 
(indigenous or non-indigenous) that have a more distinct trans-national dimension putting 


them on the ‘European radar’. This matching exercise will produce a number of potential 
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target investigations to choose from, once all 28 Member States go through the same 
exercise. How then best to translate ECIM’s strategic findings? Law enforcement success is 
measured by its operational impact. It is the overall security level ‘produced’ by law 


enforcement that will determine its perceived value. 


8.7.1. Trans-national cooperation in a NIM context 


There is an additional difficulty to be considered when using international dimension as the 
decisive variable to prioritise investigations at national level. An organised crime group 
acting internationally has different parts of its organisational structure active in different 
countries. Running a criminal business basically requires (a) the acquisition of the 
commodity, which can include a production process and the acquisition of the respective raw 
material; (b) the transportation and distribution of the commodity to the ‘customer’ ; 

and (c) the accumulation of profits.” In an international set-up these activities are assigned 
to different groups of individuals having different functions and positions within the criminal 
organisation. Consequently, an organised crime group will look different in different 
countries. This is where the difficulty starts. If an organised crime group is targeted in a trans- 
national context the contributions by national law enforcement agencies have to focus on the 
specific activity of the organised group. In a best-case scenario these individual activities will 
lead in individual Member States after successful investigations to the conviction of the 
respective group members. In a worst-case scenario law enforcement activities in several 
Member States will only help to support the conviction of certain group members in another 
Member State. Taking into account that law enforcement has to show tangible results the 
latter rather altruistic law enforcement approach will not receive a lot of support. Supporting 
the success of a law enforcement agency in another country means available resources at 
national level are diverted to an activity that will not offer a direct reward - the expected 
tangible ‘return on investment’ will not happen. In an environment where resources get 
scarcer with the portfolio of tasks widening at the same time this is a difficult ‘seller’. 
Therefore, the decision making process regarding specific targets has to reflect these 


discrepancies. 


© With a reflection on the disputed business-like model to be applied to organised crime it is recognised that 
these steps indeed do reflect a business-model and could contradict what was argued earlier on. However, 
what is described here is a very generic business-model. In contrast to the earlier discussion this model does 
not refer to the experiences gained when looking at mafia-type structures. Beyond the generic business- 
model there is no further similarity with legitimate business models. 
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The following example illustrates the complexity and the resulting difficulties for national 
law enforcement agencies involved. Smuggling cocaine is a well-established and still 
lucrative criminal activity for organised crime groups. The majority of cocaine is coming 
from Central and South America. The main entry and distribution points for cocaine 
trafficked from this region are major ports in North West Europe, the Iberian Peninsula, 

and the Black Sea. In the past the trafficking was mainly dominated by Colombian organised 
crime groups. Over recent years Mexican organised crime groups are also emerging as 
traffickers to European markets. These groups use sophisticated trafficking and concealment 
methods. Improved techniques of incorporating cocaine into other materials makes detection 
more and more difficult. However, investigations into the trafficking of cocaine are still 
prominent in Member States and law enforcement agencies have invested for decades to 
know the playing field. In the given example intelligence has been received that a 
considerable amount of cocaine is trafficked into the European Union originating from 
Colombia. The amount is estimated to be 150kg of cocaine. If the cocaine can be seized and 
the individuals involved in the trafficking and/or the distribution are arrested the final 
sentence after conviction will result in the maximum sentence foreseen in the penal code of 
the Member States concerned. Intelligence further indicates that the cocaine is intended for 
distribution to the illegal market in Denmark. It is unknown if the cocaine is immediately 
distributed or warehoused. The cocaine is trafficked from Colombia via Spain, France, 


Belgium, the Netherlands, and Germany to reach its final destination in Denmark. 


The cocaine will be trafficked via ship from Colombia to Spain. The individuals responsible 
for delivering the cocaine to a sea port in Spain are Colombian nationals, who also have 
Spanish nationality. In Spain the cocaine will be taken over by a lorry. The lorry belongs to a 
French company and the individuals driving the lorry are French nationals. The lorry will be 
driving from Spain to the Netherlands via France and Belgium. In the Netherlands the 
cocaine will be reloaded onto a lorry which belongs to a Danish company. The driver is a 
Danish national. To reach the final destination in Denmark the lorry will have to cross 
Germany. Available intelligence does not provide an exact date for the actual delivery to 
Denmark. The only information available refers to a day/time of the expected arrival of the 
cocaine in Spain. The details of the vehicles and the identity of the individuals involved in the 
trafficking activities are known. It is not known if all the cocaine is supposed to be delivered 


to Denmark or if the delivery gets divided into smaller portions during the reloading. 
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These details refer to a slightly simplified real case which contains all the ingredients of a 
criminal investigation linked to an organised crime group acting at an international level and 
is a classic example of a trans-national criminal investigation as the result of the priority 
settings of the ECIM when strategic findings are operationalised. Denmark as the final 
destination for the distribution of the cocaine has the greatest interest to run a coordinated 
operation involving law enforcement agencies in Spain, France, Belgium, The Netherlands, 
and Germany. Necessary cooperation with the Colombian authorities is excluded from the 
example for reasons of simplification, although the Colombian authorities would have a 
crucial role to play when it comes to the money-trail. After initiating such a coordinated 


operation decisions have to be taken at national level regarding the resource planning. 


In the beginning especially the French authorities are carrying the burden. Although it is 
known when the cocaine will arrive in Spain it is not known when the cocaine will be picked 
up. In the given case the French surveillance team had to follow the French lorry when it was 
heading for Spain around the time of the expected arrival of the cocaine in Spain. Taken into 
account that operational law enforcement activities remain in the hands of the Member State 
concerned it is impossible that a Spanish surveillance team takes over this task on French 
territory. To directly engage with the French company owning the lorry would have entailed 
the risk that the operation gets leaked to the organised crime group involved. At the 
French/Spanish border the surveillance is handed over to a Spanish team. The French team 
has to be on standby as they will have to take over once the lorry has picked-up the cocaine 
and is on its way to the Netherlands. When the cocaine is picked-up at the seaport in Spain it 
turns out that the lorry is not immediately returning to France. The lorry is delivering other 
commodities on the way back from Spain to several cities in Spain, delaying the expected 
return. After three additional days the lorry heads towards the French border, an unforeseen 
extension of the initial operation. French authorities have to decide to keep the surveillance 
team in place or to deploy the team to another operation. After the lorry has crossed the 
border and is under French surveillance the drugs are transported to the Belgian border where 
the surveillance is taken over by the Belgian authorities. The same principles apply when 
entering the Netherlands. In the Netherlands the French lorry stops at a parking space at the 
motorway and the driver is met by an individual who had arrived in a Danish lorry. 
Unforeseen the individuals under surveillance are joined by a third unidentified individual 


who had arrived in a Dutch lorry. 
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It is impossible for the Dutch surveillance team to determine the role of the unidentified 
individual. In the course of the action it becomes clear that something is reloaded from the 
French to the Danish and the Dutch lorries. The Dutch surveillance team has to bring in a 
second team to follow the Dutch lorry in case that some of the cocaine had been reloaded 
onto this lorry. The Dutch lorry then heads towards the German border which requires an 
extra German surveillance team to take over the surveillance. The Danish lorry continues to 
drive to Denmark via Germany. Finally the Danish lorry is taken over by the Danish 
authorities from the German surveillance team. During the night the Danish lorry gets 
unloaded. The circumstances of the unloading indicate that the cocaine has reached its final 
destination before distribution. The Danish law enforcement authorities arrest the driver and 
the people present during the unloading. It turns out that all the cocaine was delivered to 
Denmark. The final court trial is limited to the individuals arrested in Denmark. Denmark did 
not request the extradition of the individuals involved in the trafficking which is due to the 
expected non-proportional efforts needed (conforming with the requirements set out in the 
European Convention on Mutual Legal Assistance in Criminal Matters) and the expected low 
sentencing. These individuals are also not subject to an investigation in the respective 
Member States concerned as a result of striking the balance between. The expected efforts 
required and the expected outcome in court as there would be a need to prove that these 
individuals knowingly were part of the organised crime group involved in the trafficking of 


cocaine to Denmark. 


Each national law enforcement agency had to take decisions regarding the actual offence 
under which the case was investigated to allow for the respective deployment of resources. 
Another aspect the involved prosecutorial services had to decide was the question if it was 
legal that 150kg of cocaine were transited through their country without having the final 
control over the drugs. Again, in a worst-case scenario the drugs might have gone missing in 
a different jurisdiction - how could that be justified? In addition, it is not clear if all 
individuals involved are actually members of a single organised crime group or were an 
amalgamation of different groups taking an opportunistic approach to benefit from the need 
to have a lengthy supply chain in place. The example might look complex at first sight; 
however, these trans-national organised crime cases are the rule not the exception, especially 


in a Europe without internal borders when it comes to the free-movement-of-goods-principle. 
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Unfortunately, law enforcement has not gone through the same kind of harmonisation in 
cross-border cooperation. The law and related rights and obligations for those enforcing it 
still end at the border. The ECIM when operationalising strategic findings has to 
accommodate these difficulties. Returning to the need of law enforcement agencies for 
producing tangible results to be regarded as successful the example does not offer too many 
of these tangible results. Of the countries involved only the Danish law enforcement 
authorities were able to achieve such a result, Spain, France, Belgium, The Netherlands, and 
Germany were not. Nevertheless, without the support of these countries the Danish success 
would not have been possible. Had the Spanish decided to seize the cocaine at the border 
crossing to France the success would have been for Spain but the further trafficking route and 
the identification of the individuals involved would have remained unknown. From the 
perspective of disrupting organised crime groups effectively it was important to let the whole 
operation run from start to finish as the information obtained during the investigation 

(a) confirmed the intelligence received, and (b) enabled law enforcement agencies in an 
orchestrated operation to disrupt activities of the organised crime group or groups involved. 
In the given example the will to cooperate was fuelled by the amount of cocaine trafficked 
and the fact that the crime area concerned was within the already described law enforcement 
comfort zone. It remains questionable to which extent such cooperation would be possible in 
cases related to missing trader intra community fraud, illicit waste trafficking, or the 
trafficking in endangered species - all crime areas that have been identified by the (S)OCTA 


as priority crime areas. 


To make the ECIM an institutionalised success targeted operationalisation in a national 
context is crucial. This requires the use of personal data. At which level such personal data is 
analysed is secondary. One option could be that the ECIM is supported by an operational 
Analysis Work File at Europol where relevant data is stored by Member States and accessed 
at a later stage to identify potential trans-national investigations to ‘fill the ECIM with 
(operational) life’. A second option would be that the data stored in an Analysis Work File is 
analysed by Europol using the strategic findings of the (S)OCTA as a paradigm to identify 
those investigations that best fit the respective (S)OCTA variables. Both options do have their 
short-falls. When leaving the decision to Member States it is mandatory to establish a 
mechanism to prioritise ‘competing’ investigations. Such competing situations are not 
unlikely to happen. Organised crime groups acting trans-nationally will in many cases have 


been on the radar of law enforcement agencies at national level. 
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The actual threat posed by the individual branches of such trans-national organised crime 
groups active in different Member States will be evaluated differently. This is illustrated by 
distinguishing between the actual criminal activities of a group committed in one Member 
State (e.g. the selling of drugs, to stick to the more traditional organised crime phenomena) 
and the laundering of the criminal proceeds in another country. Whereas the country where 
the drugs are sold has a major interest in disrupting these activities the country in which 
money laundering activities have been identified might not be inclined to invest resources 
into the case as it could be too difficult to obtain the necessary evidence or even worse, the 
prosecution service might not even be convinced of the presence of a money laundering 


offence in the first place. 


Individual roles attributed to specific members of these organised crime groups will also 
differ, depending on the investigative focus applied in the national context. The earlier 
example from Germany regarding the Cali-Cartel again helps to understand the challenge. 
Regional federal states were requested to provide all information that was obtained during 
their investigations related to cocaine trafficking that could be attributed to activities of the 
Cali-Cartel. In this context it is repeated again that regional federal states in Germany are 
highly independent from central federal structures, especially when it comes to law 
enforcement (‘Polizei ist Laendersache’ - policing is the sole responsibility of the federal 
states). In the following, regional federal states provided raw/generic data that was obtained 
during their investigations. The fact that raw/generic data was provided was vital for an 
unbiased analysis as aggregated data has already been evaluated and decisions were taken to 
assign a specific meaning to individual pieces of information and intelligence. It is this this 
process at national level which shapes the focus of an investigation and identifies suspects to 
focus on. At the same time this process leads to other pieces of information and intelligence 
to be regarded as irrelevant for the investigation, either the information/intelligence is simply 
not needed within the investigative context or the efforts needed to obtain such 
information/intelligence would largely outweigh the expected results once the investigation 
gets to the court. Analysing aggregated data with a different focus is impossible as the data 
has been stripped of other potential links. The same applies to data from investigations at 
national level which would be needed within the ECIM to operationalise strategic findings. 
In a next step the data received from the regional federal states was pooled together and 


analysed with the objective to identify where information overlapped. 
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A first result showed that all investigations had entities in common data linking them. Now, 
there was a need to identify the nature of these entities, which required going back to the 


actual investigating unit. 


The interesting finding was that the nature of the linking entities differed considerably 
depending on the individual investigation. In some cases the same individual was regarded as 
a main suspect whereas in other cases the same individual in different investigations was only 
considered to be in the margins of the investigation. Although some variance was expected 


the magnitude of these differences surprised. 


The analysis revealed that the need to match the subject of an investigation with the 
respective offences in the penal code and consequently to identify the major targeted suspects 
led to an early selection process regarding the role of these individuals within the criminal 
organisation. Once the main subjects had been selected for the investigation there was only 
little room to change the assigned roles. Although it cannot be excluded that an individual has 
different roles in different investigations it is difficult to understand that a main suspect in 
one investigation only is regarded as of marginal interest in another investigation. This seems 
rather to be based on the initial selection process than on available information/intelligence. 
The analysis helped to improve the general information exchange related to ongoing 
investigations at national level. However, the magnitude of the discrepancies identified at 
national level gets multiplied in an international context. Changing the role assigned to an 
individual in an investigation, being a suspect or an individual who is regarded as not 
important for the investigation based on information from other Member States outside the 
national investigative context is difficult as the national law enforcement and prosecutorial 


machinery has already decided on the path of action. 


Europol provides an institutionalised framework to exchange data in mandated crime areas at 
European level - Analysis Work Files. Also here, Member States have total discretion in 
deciding to which extent this framework is used and which data they provide. The selection 
process will even be stricter when data related to ongoing investigations is concerned. 

Too great is the fear that an investigation at national level could be compromised if data 
linked to the investigation ‘gets out of control’ of the investigating unit. But for 
operationalising strategic findings it is essential that the ECIM has access to all the 
raw/generic data available in Member States related to the investigations run in a prioritised 
crime area or regarding a prioritised organised crime group. Not to acquire the raw/generic 


data would be a mistake. 
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As mentioned above working with aggregated data will only result in self-fulfilling 
prophecies as the fixed value-tag provided together with the information/ intelligence will 
make it literally impossible to allow for a different perspective on the data. Another 
requirement is that information provided originates from the most current investigations. 
Reflecting on past investigations does not help to confirm or refute future oriented strategic 
findings of the (S)OCTA as the core of the ECIM. Both requirements are a challenge for 
Member States as they need to give up the national prerogative for a European respectively 
international perspective. Nevertheless, the already mentioned paradigm shift needed for an 
ECIM to work requires such fundamental changes. In a postmodern society these changes 
might just come ‘natural’. For law enforcement still best described as being deeply rooted in 


a modern self-conception this might turn out to be the most difficult steps to take. 
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9. The OCTA as the engine to drive the ECIM 


The main component fuelling the ECIM is the Serious and Organised Crime Threat 
Assessment - SOCTA.”* So far, it has been demonstrated that there is still some way to go to 
harmonise operational law enforcement efforts at national and the strategic law enforcement 
perspective at European level. According to the conclusions of The Hague Programme in 
2004 the ECIM represents the core concept to tackle organised crime with the (S)OCTA as 
key element of the model based on synchronised national assessments.” 

This objective remains valid. For national assessments to be synchronised to feed the 
(S)OCTA Member States need to understand what the (S)OCTA actually is and what it is not. 
Only if the (S)OCTA is conceptualised at national level a targeted synchronising process can 
be developed. However, there is no universally agreed definition of what constitutes a threat 
assessment. A threat assessment can be based on quantitative or qualitative data only or it can 
combine both elements. With regard to the (S)OCTA Grabosky and Stohl (2010, p. 33) 
conclude that the (S)OCTA is more qualitative than statistical (quantitative). They finish by 
stating that ‘neither qualitative nor quantitative data provide perfect knowledge of organised 
crime ... But they do provide complementary information that enhances our understanding of 
patterns and trends’. According to Europol’s Analytical Guidelines a Threat Assessment 
‘goes beyond the scope of a ‘traditional’ Situation Report and is defined as a product which 
analyses and evaluates the character, scope and impact of criminality. Most often a Threat 
Assessment will be long term, future oriented and therefore has the most difficult level of 


analytical ambition.’ 


Assessing threat includes concepts related to risk, harm, impact, and vulnerability (these 
concepts will be discussed in more detail at a later stage in this thesis). As the concept for a 
threat assessment is complex the following charts should provide a better understanding for 
the discussion. The charts also explain the conceptual model underlying the threat assessment 


used for the (S)OCTA and the requirements for implementing the ECIM at national level. 


Initially referred to as the Organised Crime Threat Assessment (OCTA) 
™ COM(2005) 232 final 
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To develop a common framework for a qualitative data collection mechanism at Member 


State level assimilating the requirements of the (S)OCTA is challenging but achievable, even 


if it is difficult to define and to agree on common qualitative criteria to be collected across 


Member States. 
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national level: 


The (E)GIM at national case level: 
Strategic 
4 Analysis ~ 
Review Criminal Business 
(debriefing of results) Analysis 
Law a. 
Enforcement nays 
Action = 
Network vA Letts 
Infiltration Pesaigcs 
{intelligence based) Selection 


Page 106 of 146 


Combining the strategic findings of the ECIM after operationalisation with the activities at 


national level results in the following relationship: 


The (E)CIM 
at national 
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Action 


Analysis defines priority intgnce (3) 
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10. The importance of societal developments - the postmodern 


link 


To be able to introduce and implement a European Criminal Intelligence Model it is 
important to understand in which societal environment such a model is embedded. 

To understand to which extent law enforcement agencies at Member State level do represent 
a homogeneous set-up in which such a model can be applied is as important. 

Having addressed these questions it remains to evaluate if such a model has to stay at a 
generic level, allowing for individualised approaches when implementing the model or if the 
model needs to be more detailed down to the level where strategic findings are 
operationalised to allow for a unified approach at national level, which in return will result in 
a unified European approach for tackling organised crime. Law enforcement does not exist in 
a vacuum. Being at the heart of what constitutes a state policing and law enforcement are 
heavily influenced by existing social, cultural and historical variables present at national 
level. Moving up to the European level these considerations are even more important as it 
currently still is unclear which role the EU can play when it comes to defining common law 
enforcement strategies based on a universally applicable criminal intelligence model. 

In this context it is necessary to analyse the state society is currently in. Another aspect to be 
considered refers to the question if societal developments are mirrored in the law 
enforcement community or if the change-rate of the law enforcement community is of a 
different speed, which might result in conceptual models that do not reflect the needs of an 


existing reality. 


Law enforcement is regarded as one of the cornerstones that are central to the concept of a 
state and the state for a long time has been regarded as the smallest indivisible entity - to a 
certain extent comparable to the concept of the atom as the smallest part of matter before 
scientific advancement showed that this concept has been considerably wrong. Along these 
lines it might be that also the traditional Weberian state concept has reached a cross-road, 
where it remains to be seen if the state continues to represent a single unified entity or will 
have to be looked at as a “discontinued model’ which is replaced by a more fluid concept. 
Continued globalisation and virtual realities introduces by the ever expanding cypher-space 


have already impacted on the understanding of the nation state concept already. 


Page 108 of 146 


10.1 Modern, postmodern - does it play role for the ECIM? 


Society has gone a long way. During the Middle Ages life in Europe was dominated by 
religious beliefs. When moving out of the Middle Ages new ways of thinking started to 
challenge this view. In the sixteenth century the Reformation movement and new scientific 
discoveries led to a different perspective on the nature of the world. The outcome of these 


developments is generally referred to as Enlightenment or modernity. 


The main characteristics of modernity are referring to the acceptance of the explanatory 
power of the natural sciences and the existence of meta-narratives, providing a logical and 
holistic perspective of the world. However, modernity is not the final state of the art. 

On the contrary, the certainties of modernity have led to the uncertainties picked-up by 
postmodernism. Modernity can be described as the intellectual and cultural conceptualisation 
of the era of Enlightenment, especially the rejection of traditional sources of authority in 
favour of reason and knowledge as the actual corner stone to explain and understand the 
world. Modernity has produced a variety of social, political, legislative, technological and 
economic developments, including democratization and consumerisation. 


Another key element of modernity is linked to the concept of progress. 


With modernity moving into a societal context of consumerisation compared to production 
before, rational certainty and self-awareness more and more have developed into scepticism 
and fragmentation. These developments have considerably changed the paradigm of 
modernity. Some refer to this shift as ‘late modernity’, implying an existing continuity with 
the concept of modernity, whereas others have taken a step further by arguing that 
postmodernity has ended modernity, introducing a new conceptual framework. 
Postmodernity refers to the increasing number of questions marks regarding the era of 
Enlightenment and its conceived ability to provide overarching answers in a more complex 
growing world after the Second World War. The development gained further momentum 
from the seventies to the nineties as the negative consequences of modernity became more 
apparent, e.g. climate change, dominance of economic interests, exploitation of natural 


resources, experienced social and judicial injustice. 


Postmodernity is characterised by Relativism, Pluralism, Subjectivism and Fragmentation. 
Relativism means that what is regarded as valid (true) for a specific group may not be valid 


(true) for others. Pluralism, accepts that diverting opinions are equally valid. 
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Claims of exclusivity are not substantiated. Subjectivism, as opposed to the modern concept 
of objectivism, allows for the fact that a specific truth value can alter depending upon the 
perspective of the observer. In addition, a judgement which perspective is right or wrong 
cannot be made. Fragmentation takes into account that an overall cohesiveness amongst 
different groups does not exist, rather the opposite, there is a tendency towards smaller 
groups trying to lobby for their individual course. These groups are characterised by their 
single dimension, which is often expressed by one-dimensional attributes like ecological, gay, 
feminist, or fundamentalist. Consumerism is the role model for the priority of freedom of 
choice. Opinions and preference change quickly and are to a large extent influenced or 
defined by the media. In the sense that modernism focused on human self-confidence and an 
overarching contextualisation, postmodernism focuses on instability. Not only time is 
relative, everything else is: truth, reasoning, civilization, or justice. Postmodernity regards 
knowledge as contextual in scope and interpretation. Contexts are not universal, rather local, 
depending upon time, place, and culture. Objectivity is seen as an attempt to present an 
ideological perspective hidden as an established fact. The difficulty that came to light with 
modernity was that modernity after the Second World War offered a world without a 
constant. The ultimate belief that technological progress would be able to solve whatever 
problem in a positive way could not be turned into reality. Modernity was a way of making 
sense of the world, to finally close in on the ‘Theory of Everything’. Modernity was 
convinced that science based entirely upon undisputed and objective facts would replace the 


need to rely on any other kind of value systems, especially those based on belief. 


The concepts of epistemology and hermeneutics in modernity were clear and straight 
forward, only scientific methods were able to detect objective truth and when interpreting the 
significance of such findings again only science was able to do so. Postmodernity disputes 
such an approach, instead of striving for a holistic answer postmodernity is trying to find a 
tailored approach for coping with life. Postmodernity recognizes the limitations of the human 
condition and the difficulties of a value free approach in a contextualised reality. It accepts 
that truth can be generated from a variety of different sources, acknowledging at the same 
time that truth as such does not exist. Truth is rather perceived as of a subjective nature 


depending on perspective - what is true for some may not be true for others. 
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Nietzsche (1886) described this approach much earlier when he referred to his perception that 


so-called objective truth claims have to be seen as merely covert assertions of power. 


Criticism linked to postmodernity is often based on the underlying theoretical concept of 
denying objectivity. By insisting that all truth claims are relative and that no single truth 
system can claim singular objectivity postmodernity again has just created another absolute 
truth system, although based upon pluralism and tolerance. This criticism is reflected by Best 
and Kellner (1997) when they conclude: ‘does not the very concept of postmodernity 


, a0 - 576 
presuppose a master narrative, a totalizing perspective.’ 


There are no universally agreed definitions regarding the meaning of postmodernity. 
Different authors express different ideas. Some even prefer the term ‘late modernity’ to 
‘postmodernity’. However, there seems to be a broadly accepted general understanding that 
there are fundamental differences when talking about modernity and postmodernity. 


Modernity is changing, the degree of which still subject to ongoing discussions. 


To be successful the ECIM has to take these developments into account. The validity of 
traditional law enforcement approaches placed within a Weberian state concept are 
questioned. Even if the EU structures in Brussels are requesting an overarching OCTA to 
define strategic priorities there seems to be too much of a modern perspective believing in a 
grand-narrative as the appropriate answer to tackle organised crime. There are many 
indicators pointing in a postmodern direction which require from the ECIM to be more 
diversified. The regionalisation of the OCTA (hub approach) and the focus on the individual 
set-up of organised crime groups are the first step to align a European perspective with the 
needs resulting from a more postmodern societal context. To be clear on the modern or more 
postmodern nature of society plats a decisive role for the ability to effectively implement the 


ECIM. 


® EW. Nietzsche, Chapter I: Prejudices of Philosophers (no. 9), Beyond Good and Evil, Aziloth Books, 2010 
7S. Best and D. Kellner, The Postmodern Turn, Guilford Press, 1997 
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11. Data protection needs for a European Criminal 


Intelligence Model 


As described in detail in this thesis the European Criminal Intelligence Model is meant to 
provide a ‘steering wheel’ for decision makers to direct law enforcement efforts to be more 
effective in tackling organised and serious crime beyond the national perspective by taking a 
holistic approach in identifying law enforcement priorities. As such, the ECIM is a strategic 
tool based on a strategic concept. In the area of strategic intelligence analysis questions 
related to data protection do not arise as strategic information is generated from aggregated or 
anonymous data, not identifying the actual individual data it is derived from.”” 

However, taking into account currently available technical means the question remains if 
aggregated/anonymous data is really safe against re-constructing the underlying raw data and 
more important if the ECIM really can work if the model only is based on aggregated non- 
personal data. Regarding the question if aggregated data can be re-constructed to give away 
the underlying personal data and therefore requiring specific data protection safeguards it will 
be necessary to take closer look at the data needed to keep an ECIM ‘running’ with a focus 
on the operationalisation of strategic findings and how the ECIM actually needs to function to 


be able to direct trans-national investigations within the EU and beyond. 


” According to the Opinion 4/2007 on the concept of personal data by the Article 29 Data Protection Working 
Party ‘anonymous data’ can be defined as any information relating to a natural person where the person 
cannot be identified, whether by the data controller or by any other person, taking account of all the means 
likely reasonably to be used either by the controller or by any other person to identify that individual. 
"Anonymised data” would therefore be anonymous data that previously referred to an identifiable person, 
but where that identification is no longer possible. Recital 26 also refers to this concept when it reads that 
“the principles of protection shall not apply to data rendered anonymous in such a way that the data subject 
is no longer identifiable”. Again, the assessment of whether the data allow identification of an individual, 
and whether the information can be considered as anonymous or not depends on the circumstances, and a 
case-by-case analysis should be carried out with particular reference to the extent that the means are likely 
reasonably to be used for identification as described in Recital 26. This is particularly relevant in the case of 
statistical information, where despite the fact that the information may be presented as aggregated data, the 
original sample is not sufficiently large and other pieces of information may enable the identification of 
individuals. Article 29 Data Protection Working Party, ‘Opinion 4/2007 on the concept of personal data’, 
http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2007/wp136_en.pdf, viewed on 7 October 2015 
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11.1 Data needed for ECIM 


The ECIM representing a strategic intelligence cycle requires data input to initiate the 
analytical process. Data is generated at Member State level as a result of data extracted from 
ongoing and past criminal investigations. To be able to have a homogeneous data base across 
27 Member States it is necessary to define the actual data that needs to be collected and 
reported for the ECIM. Standardised data transmission is of key importance if the analysis of 
this data is supposed to produce a reliable and valid outcome. What now constitutes such a 
standardised data set? The ECIM shows some striking similarity to a large scale Management 
Information System (MIS). According to Gupta (2011) Management Information Systems 
can be defined as systems that among other functionalities provide support to managerial 
functions like planning, directing and controlling and collect information in a standardised 
manner. In other words, MIS consist of interrelated components which collect, process and 
distribute information to support the decision making process of managers in an organisation. 
Management Information Systems supply decision makers with facts, support and enhance 
decision making processes. At the most senior levels, they provide strategic data and 
information to help to take strategic decisions. To be effective a MIS has to facilitate the 
decision making process by providing information within an appropriate time frame to help 
the decision maker to select the best course of action. This description reflects what has been 
said so far about the reasons for promoting an ECIM. If the analogy between the ECIM as a 
MIS is valid there should also be a similarity regarding the information required within the 


ECIM and information required in a Management Information System. 


Kanter (1996) defines strategic information needs as unstructured, futuristic, non- 
programmed, inexact, and external. In the framework of an ECIM these attributes can be 
related to attributes used for the ECIM: Prone to a constantly changing criminal environment 
(unstructured), future oriented (futuristic), depending on identified intelligence gaps 
(inexact), and driven by the activities of the criminal counterparts (external). 

The non-programmed feature does not really come into play, as the overall concept of 
Management Information Systems focuses on mainly computerized systems, whereas the 
ECIM due to the focus on the intelligence component relies on the human interface, the 
analyst. In line with Kanter’s definition, strategic information needed for the ECIM can rely 
on aggregated, non-personal data. The required data has to mirror the concept of what 


constitutes the main characteristics of organised and serious crime groups. 
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These characteristics have changed over the last 20 years. The fact that such changes have 
taken place over two decades is not surprising; however, examining these changes under the 
premise of moving from a modern to a post-modern perspective makes these changes more 


interesting. It took time to agree on a European definition of organised crime. 


In 1997 Enfopol35rev2 was adopted by the Council of Ministers.’ This document defined 
that in order to speak about organised crime at least six of the following characteristics 
needed to be present, four of which must be those numbered 1, 3, 5 and 11 (mandatory 


requirements): 


1. Collaboration of more than 2 people; 

2. Each with own appointed tasks; 

3. Fora prolonged or indefinite period of time (refers to the stability 
and (potential) durability); 

Using some form of discipline and control; 

Suspected of the commission of serious criminal offences; 
Operating at an international level; 

Using violence or other means suitable for intimidation; 


Using commercial or business-like structures; 


ee eS en 


Engaged in money laundering; 
10. Exerting influence on politics, the media, public administration, 
judicial authorities or the economy; 


11. Determined by the pursuit of profit and/or power. 


From today’s perspective the mandatory requirements to be fulfilled seem somewhat odd, as 
except for the need to be in existence for ‘a prolonged or indefinite period of time’, the other 
mandatory requirements are begging the question of what is regarded as the underlying 
principles to qualify as organised crime group. The qualifying aspects would exactly have 
been those that were mandatory. Especially the last requirement referring to being 
‘determined by the pursuit of profit and/or power’ is superfluous. What other intention would 
one expect to find in whatever criminal set-up? To be criminal for the sake of being criminal 
seems a rather unlikely concept. However, this discussion will not be further pursued as such 


a discourse would go beyond the scope of this thesis. 


8 Council of the European Union (1997) Doc 6204/2/97 ENFOPOL 35 REV 2 of 21 April 1997 
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What is interesting in the aforementioned choice is the approach underlying this selection. 
The approach finds its origin in a law enforcement concept which is marked by ‘modernism’. 
As explained the main characteristics of ‘modernism’ are attributed to a grand-narrative and 
the ability to fully account for a given situation by a single perspective which at the same 
time is regarded as the only perspective possible. Enfopol35rev2 is a good example for such a 
modern approach and the changes that have taken place in the way this definition is applied 
underline the statement. Enfopol35rev2 has provided the framework of the data collection 
requirements for the Organised Crime Situation Report (OCSR) and the Organised Crime 
Report (OCR). With the introduction of the new methodology for the Organised Crime 
Threat Assessment in 2005 (Crimorg56/2005) the conceptual framework regarding data 
collection requirements changed. However, it has to be acknowledged that Enfopol35rev2 
has never been officially revoked. The changes might look subtle but a detailed reflection 
will show that the changes indeed were fundamental reflecting much more a post-modern 
approach. The 2007 OCTA starts by outlines the characteristics that have been chosen to 


evaluate organised crime groups with regard to their actual threat potential: va 


. International dimension; 

. Group structure; 

. Use of legitimate business structures; 
. Specialisation; 

. Influence; 


. Use of violence; 
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. Counter-measures. 


None of these characteristics refers to the mandatory requirements set-out in Enfopol35rev2. 
‘International dimension’ is close to “operating at an international level’; ‘group structure’ 
combines ‘collaboration with own appointed tasks’, and ‘engaged in money laundering; 
‘Use of legitimate business structures’ equals “using commercial or business-like structures’ ; 
‘specialisation’ shows some similarity to ‘collaboration with own appointed tasks’; 
‘influence’ refers to the concept of ‘exerting influence on politics, the media, public 
administration, judicial authorities or the economy’; ‘use of violence’ is the same as ‘using 
violence or other means suitable for intimidation’ and ‘counter measures’ is a new 


perspective not looked into before. 


”  https://www.europol.europa.eu/sites/default/files/publications/octa2007.pdf, viewed on 12 June 2013 
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Although this comparison shows some similarity between the concept used for the 

2007 OCTA and Enfopol35rev2 it is evident that perspectives have changed. The fact that 
individual descriptors have become more a heading than a description in itself is an indication 
that the underlying conceptual framework is more flexible respectively broader than before. 
In addition, the new descriptors are more focusing on establishing a behavioural pattern 
rather than ticking boxes to identify an individual organised crime group as being an 
organised crime group. The new approach moves away from a descriptive reporting by trying 
to develop an understanding how organised crime manifests itself. The basic assumption is 
that organised crime groups do differ from each other in their behaviour, at least with regard 
to the internal set-up, the area of criminal activity, and the geographical situation. The new 
approach does not accept a one-size-fits-all organised crime landscape, especially not with a 
European perspective in mind. The shift as a result of the new OCTA methodology can also 
be recognised in chapter on the structure of organised crime groups. Of course, one would 
expect such a chapter in any analytical report focusing on organised crime. However, the 
perspective chosen points towards the new conceptual framework by creating four basically 
different structures for organised groups: (a) oriented clusters, (b) non-EU cell-like criminal 
groups, (c) mainly ethnically-based, trying to exert influence over a non-integrated ethnic 
community residing in the EU, and (d) loose networks. Without going into further details, 
these groups are different because they show a different behaviour in how they are organised 


and how they are active in the EU. 


These characteristics are unrelated to the actual origin of the group. Organised crime groups 
are rather looked at as organic structures which can be best described by their general 
behavioural pattern. Although these simplified categories might look like a typical ‘modern’ 
perspective it has to be realised that this perspective is far away from a much more 
monolithic view taken on organised crime groups in the past. The question that remains to be 
addressed is how and if such a perspective really does help law enforcement to be more 
effective in tackling organised crime. For the time being, it seems that such a broad 
perspective makes law enforcement rather more difficult and amorphous without providing a 
tangible outcome. It is central to strike a balance with the evidential necessities requested by 
the respective penal codes in Member States. To prove a suspected offence in court leads to a 
conviction, nothing else. However, an approach going beyond a purely legalistic perspective 


seems to be more effective in developing successful counter-strategies. Such an approach 
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starts from the premise that not only a successful conviction disrupting a criminal activity 


provides the repository for the data collection for the OCTA. 


11.2 Data protection implications for strategic products 


By definition a European Criminal Intelligence-Model is not limited to national boundaries. 
The model takes a bird’s eye view on the crime situation in Europe. The model also needs to 
take into account available information from other parts of the globe as additional input to be 
able to provide a holistic picture aimed at strategic decision making. In addition, the ECIM 
not being limited to criminal-intelligence as described before relies on data that is available 
from third parties and private entities. Now, the question to be answered refers to the nature 
of this information as the origin of the information used will define the need to consider data 


protection requirements as a result of existing regulations. 


In the past, there was an easy distinction applicable: personal-related-data requires data 
protection whereas non-personal-related-data did not have to comply with such requirements. 
To be more precise, this distinction is still valid. What has become more complicated is 
defining the dividing line between what constitutes personal data and what does not. 

The reason for this blurring line can be found in new technologies which provide for 
advanced means to re-construct personal data from non-personal or aggregated data. 

For the bird’s eye view the ECIM it seems obvious that no personal data is required as such, 
given there is a commonly agreed understanding of what constitutes personal data. 
Unfortunately, such a universal definition does not exist. In general, personal data refers to 
data that can be attributed to a specific individual, allowing the identification of the 
individual. As the EU consists of individual Member States the definition of personal data 
differs from Member State to Member State. And with the EU having a legal personality on 
its own, definition number twenty-eight is added to the menu. A quick reflection on some of 
the existing definitions in the EU illustrates the existing diversity. The definitions are not 
fundamentally different, however, in a sensitive area like personal data the devil lies in the 


details. 


e Austria: Information relating to data subjects who are identified or identifiable. ep 


8° Austrian Federal Data Protection Act 2000, Data Protection Directive (95/46/EC) 


Page 117 of 146 


e Italy: Any information relating to natural or legal persons, bodies, or associations that 
are, or can be identified, even indirectly, by reference to any other information 
including a personal identification number.* 

e Ireland: Data relating to a living individual who is or can be identified either from the 
data or from the data in conjunction with other information that is in, or likely to 
come into, the possession of the data controller.®? 

e Poland: Any information relating to an identified or identifiable natural person, where 
identifiable natural person is defined as one who can be identified, directly or 
indirectly, in particular by reference to an identification number or to one or more 
factors specific to his/her physical, physiological, mental, economic, cultural or social 
identity. ... A piece of information shall not be regarded as identifying where the 
identification requires an unreasonable amount of time, cost and manpower.** 

e United Kingdom: Any data relating to an identified or identifiable living individual, 
where data is defined as automatically processed data; data forming part of a relevant 
filing system; data forming part of an accessible record; and data recorded by a public 
authority.** 

e And finally, the European Union: Any information relating to an identified or 
identifiable natural person; an identifiable person is one who can be identified, 
directly or indirectly, in particular by reference to an identification number or to one 
or more factors specific to his physical, physiological, mental, economic, cultural, or 


social identity.® 


Although all definitions are reference the European Data Protection Directive the actual 
wording deviates from the Directive. What all definitions have in common is that one way or 
the other personal data is regarded as data which identifies the individual behind the data. 
Hence, non-personal data is data which does not allow the identification of an individual. 
Such data can be either non-personal from the outset, not containing any personal data or the 
initially personal data becomes non-personal when the data is aggregated, de-identified or 


«a4 86 
anonymised. 


31 Legislative Decree No. 196, Italian Data Protection Code, Data Protection Directive (95/46/EC) 


*° The Data Protection Acts, Data Protection Directive (95/46/EC) 

83 Act on the Protection of Personal Data, Data Protection Directive (95/46/EC) 

** Data Protection Act 1998, Data Protection Directive (95/46/EC) 

*° Data Protection Directive (95/46/EC) 

8° See ‘Opinion 06/2013 on open data and public sector information (‘PSI’) reuse’ by the Article 29 Data 
Protection Working Party (1021/00/EN), adopted on 5 June 2013 
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The ECIM as the strategic tool at EU level to decide upon law enforcement priorities for 
tackling organised crime needs to be based on data generated from criminal investigations. 
Criminal investigations in any EU Member State are directed specifically against individuals 
for the suspected violation of existing laws. The link between criminal investigations and 
personal data is evident. However, it will be necessary to determine if the data used for the 
ECIM when transferred from the national to the European level qualifies as personal or 
aggregated data which eventually could be reconstructed to equal personal data. The ECIM is 
supplied with data generated at national level. If this data corresponds to personal data 
obtained at Member State level there is no doubt that the ECIM has to comply with existing 
data protection regulations. But the ECIM does not need this kind of data. 


At least not in the current set-up for the ECIM as mentioned before. 


As the ECIM is the result of information available in 27 Member States, at EU level, from 
outside the EU, and from private partners there is a need to reach a common level of 
abstraction to harmonise the data provided. This requirement is based on the fact that the data 
to be analysed needs to be manageable in volume and even more important, the data needs to 
be of the same quality to be comparable. Criminal investigations in Member States are based 
on provisions provided for in the national penal code and the actual procedural framework is 
defined by the respective national code of criminal procedures. Both, the penal code and the 
code of criminal procedures, are reflections of a specific national set-up, taking into account 
specific social, cultural, and historical conditions in Member States. The aforementioned 
illustrated difference regarding the definition of what constitutes personal data in a European 
context is magnified when it comes to national provisions related to the use of personal data 
applied in the context of a criminal investigation. As a result, available raw data in Member 
States is difficult to compare. Therefore, data input for the ECIM has to be based on more 
aggregated data. Data which reflects the information needed to allow for a comparative 
analysis, to set strategic direction and to enable decision making. It was said that stripping the 
ECIM to its core as a strategic tool to support and direct decision making bears similarities to 
a Management Information System (MIS) at EU level (as referred to on p. 100 et seq.). 

The underlying not aggregated raw data will be important when the findings of the ECIM are 
channelled back into the national intelligence model and turned into operational and tactical 
activities. However, this process takes place at national level and is not central to the main 


objectives of this thesis. 
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The need for data protection considerations within the core ECIM cycle itself is limited. 
Maintaining this perspective is also valid as resulting national operational activities will 
trigger the exchange of information across borders when strategic ECIM findings are 


operationalised at national or trans-national level. 


A guiding reference of the data needed for the ECIM as a Management Information System 
can be found in CrimOrg56 (2005) ADD2. The document describes the data requirements for 
the Organised Crime Threat Assessment (OCTA) and highlights the differences between the 
raw data available at national level stemming from criminal investigations and the data 
requirements for the ECIM. Where the criminal investigation at national level is directed 
against specific individuals the ECIM focuses on the comprehensive behavioural pattern of 
the organised crime groups involved. The importance of the individual for strategic decision 
making is limited. Consequently, CrimOrg56 (2005) ADD2refers to data that can be 
attributed to the group and not the individual group members. The cover note of CrimOrg56 
ADD2 stressed that data collection focuses on qualitative data in the already mentioned areas: 
international dimension of the group, the group structure, the use of legitimate business 
structures, existing specialisation, the ability to influence, the use of violence, and applied 
counter measures to counter law enforcement activities. Here, personal data as the key 
ingredient used for criminal investigation is of less importance although judicial proceedings 
in Member States will focus on trying to prove that a specific individual will have committed 
a specific offence defined in the respective national penal code. These offences are technical 
terms which define certain activities as being unlawful and that is what is judged by the 
judge. Other underlying conceptual models related to a more holistic perspective regarding 
organised crime are not relevant. Nevertheless, criminal offences do contain components 
related to the aforementioned qualitative strategic aspects considered by the OCTA but these 
aspects are not in the centre of attention during the investigation. These aspects do not 


influence the outcome of the trial. 


CrimOrg56 ADD2 contains to a total of 52 different questions including sub-questions. 
None of these questions goes below group level. This level of aggregation has also been 
maintained in the (S)OCTA, the successor of the OCTA. The information required by the 
questionnaire underlines again that the OCTA and the (S)OCTA do not rely on personal data. 
A couple of years ago, this would have been sufficient reason to argue that there was no need 
to further consider data protection regulations with regard to these strategic decision making 


tools. 
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However, public opinion has changed and data protection regulations today devote quite 
some considerations to so-called non-personal data. As the ECIM will be applied in a 
European context the most relevant considerations are coming from the ‘Article 29 Data 
Protection Working Party’. The Article 29 Data Protection Working Party is composed of a 
representative of the supervisory authority(ies) designated by each EU Member State, a 
representative of the supervisory authority(ies) established for the EU institutions and bodies, 
and a representative of the European Commission. In its opinion on ‘Open data and public 
sector information (PSI) reuse’ the Working Party concluded that the most effective solution 
to minimize the risks of unwanted disclosure of personal data is the use of statistical data 
derived from personal data under the condition that these anonymised and aggregated 
datasets do not allow re-identification of individuals. Although the PSI Directive®’ aims at 
facilitating the re-use of public sector information by harmonizing the conditions for re-use 
across the European Union and removing unnecessary barriers to re-use in the internal market 
the opinion by the Working Group is of general importance for the data used within the 
ECIM. This opinion needs to be seen in conjunction with the Working party’s opinion on the 
draft Police and Criminal Justice Data Protection Directive which was adopted on 

26 February 2013.°8 Here, the Working Group specifically refers to the use of data on non- 
suspects and underlines the need for a distinction in the aforementioned Directive between 
categories of persons that have a direct or (possible) indirect link with a specific crime or 
suspects and other persons. In 2005 the European data protection authorities had already 
highlighted the need to distinguish between the processing of personal data of non-suspects 
with data of persons related to a specific crime. Processing of data of persons who are not 
suspected of having committed any crime (other than victims, witnesses, informants, contacts 
and associates) “should only be allowed under certain specific conditions and when 
absolutely necessary for a legitimate, well-defined and specific purpose’. Furthermore, such 
processing should in the view of the data protection authorities “be restricted to a limited 


period and the further use of these data for other purposes should be prohibited’. 


87 Directive 2013/37/EU of the European Parliament and of the Council of 26 January 2013 amending 
Directive 2003/98/EC on the re-use of public sector information, in OJ L 175 

88 http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionecommendation/ 
files/2013/wp201_en.pdf, 2013, viewed on 31 October 2013 
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The current (S)OCTA used for the ECIM does not refer to personal data as the data collection 
plan focuses on a group based approach. However, this encompasses an additional aspect in 
relation to the existing data protection paradigm. A group based approach requires a holistic 
perspective and cannot be limited to the definitions of a suspect as provided for by the 
respective national criminal codes. In many cases it might even not be possible to clearly 
identify the specific role an individual plays in the overall set-up of an organised crime group. 
Considering that the recognised strength of an organised crime group is based on 
specialisation, the division of tasks and the use of legitimate business structures it becomes 
quite obvious that the distinctions as requested by the Art. 29 Working Group are more than 
difficult to comply with. Unless individual members of an organised crime group are charged 
with the offence of conspiracy or of building a criminal organisation®” it will be almost 
impossible to take a group-centred approach without including information regarding non- 


suspects in the judicial sense. 


The situation is even more difficult when the processed data is referring to an organised 
crime group where law enforcement authorities involved in the investigation might not yet 
have been able to establish the actual ‘judicial label’ (suspect, accomplice, associate, witness) 
regarding individual group members. However, to limit the personal data character of the 
information provided for the ECIM to only group related information once a criminal 
investigation has been turned into formal judicial proceedings would undermine the 
underlying idea to make the ECIM a pro-active and future-oriented tool for strategic decision 
making - the ECIM again would only look into the past. Unfortunately, there are no EU-wide 
reliable data available regarding the average time for a criminal investigation into an 
organised crime group. In Germany this period has varied between 14 and 23 month over the 
last decades.” Even if these figures may not be representative for all EU countries it shows 
that criminal investigations into organised crime are time consuming. Relying only on data 
derived from investigations that are actually closed would make all ECIM related information 
anecdotal, the information referred to reflecting knowledge of the past not taking into account 


current and emerging trends. 


* In those jurisdiction of the EU Member States where such offences do exist in the criminal code 

°° See for example: L.J. Gerdes, Organisierte Kriminalitiit und regionale Konflikte: die organisierte 
Kriminalitdt in Deutschland zur Zeit der Konflikte im ehemaligen Jugoslawien, Josef Eul Verlag GmbH, 
2007 or H.J. Albrecht and H.E. Entorf, Kriminalitdt, Okonomie und europdischer Sozialstaat. Springer, 2003 
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On the contrary, the ECIM has to rely on information stemming from investigations that are 
currently ongoing or still in a pre-investigative embryonic state when it comes to defining 
who is a suspect and who is not not, still far away from any formal judicial proceeding. 
Although the ECIM will not be based on personal data the use of non-personal data is 
nowadays subject to data protection considerations, especially with regard to the risk of 


potential re-identification of aggregated data. 


To make the ECIM useful as a forward looking tool in strategic decision making a specific 
reflection is required when it comes to the use of the required aggregated data. Complex 
criminal investigations into organised crime make it difficult to limit the transfer of 
aggregated data to data that can only be attributed to suspects. In addition, the Serious and 
Organised Crime Threat Assessment is not only distributed among the EU law enforcement 
community. The (S)OCTA is distributed to a variety of different non law-enforcement 
stakeholders within and outside the European Union. Although Europol is trying to keep 
control of the individual copies that are distributed, a proper control regarding possible 
‘second level onward transmission’ by the initial receivers of the threat assessment is difficult 


to achieve. 


Another challenge with regard to the anonymised data used for the (S)OCTA is the decision 
regarding the level of aggregation that would be appropriate to make re-identification 
impossible. If data aggregation and anonymisation are not done effectively, this might result 
in the risk that individuals may be re-identified from these datasets. Therefore, data 
protection law has an important role to play in helping to determine the threshold at which it 
is safe to release anonymised and aggregated data. For the time being, the actual data 
requested from Member States is group-focused and does in principle not allow for the re- 
identification of an individual. As a result, data protection requirements in light of the 
datasets used for the ECIM/(S)OCTA currently do not constitute a major hurdle for the 
implementation. However, as the ECIM will also be fed-back into the national or trans- 
national law enforcement context the question of data protection becomes an issue once the 
strategic information is transferred into operational and/or tactical activities. Here another 
aspect needs also to be considered further: the question to which extent personal data will be 
used for the same purpose for which it was collected in the first place, but this aspect needs to 
be addressed in a different thesis focus in on the use of operationalised data from trans- 


national sources in a national context. 
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12. Assessing the threat - the underlying concept for the 


Threat Assessment component within the ECIM 


A comprehensive report addressing the impact of organised crime activities is based on the 
development of a common understanding with regard to the relationship between threat, risk, 
harm, and vulnerability. However, there are no universally agreed definitions when it comes 
to the concepts of threat, risk, harm, vulnerability, and their respective assessments. 
Europol’s ‘Analytical Guidelines’ provide a first indication with regard to the meaning of 
different forms of such analytical assessments even if the list is not exhaustive. According to 
the guidelines a Situation Report is mainly descriptive, oriented towards the current crime 
situation. As a consequence, a situation report is not as analytically ambitious or as difficult 


to conduct as a threat assessment. 


In a situation report the ambition is not to evaluate the impact of criminality, rather to provide 


a description of the current and past situation. 


Threat Assessments are written to analyse and evaluate the character, scope and impact of 
crime. They are mid to long term, future oriented, and have a more difficult level of 
analytical ambition. Risk Assessments try to identify and examine vulnerable areas of the 
society that are, or could be exploited. By examining weak and vulnerable areas, for instance 
within a certain business sector, it will be possible to give recommendations with a focus on 
potential counter measures to mitigate the risks identified. The basis for a risk assessment 


is a related threat assessment. 


From these definitions the fundamental difference between a Situation Report and a 

Threat Assessment is obvious. Situation Reports focus on the descriptive component referring 
to past incidents whereas Threat Assessments focus on identifying current and future threats. 
The evaluation of existing and potential threats posed by organised crime groups and/or 
crime phenomena leads to a prioritisation with regard to these groups/phenomena, which 
require targeted action from the law enforcement community to reduce or eliminate these 
threats. Law enforcement activities are mainly re-active when the threat already exists 
whereas in the area of identified new and potential threats law enforcement agencies are in a 


position to develop effective pro-active counter strategies. 
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To be able to identify anticipated future threats purely quantitative descriptive information 
about an organised crime group or a crime phenomenon is not sufficient. This is where the 
main difficulty lies: Information requirements for traditional policing are focused on 
numerical and empirical data. Existing data collection mechanisms in Member States are 
specifically constructed to obtain such quantitative statistical data (number of crimes 
committed, number of groups, group seize, etc.). Predictions of future developments are 
primarily based on the extrapolation of existing data. New emerging trends are hardly 
detected in such a data collection setting. As a consequence, new emerging trends will only 
be acted upon after the trends have already manifested themselves as a proven change within 
the criminal environment. Law enforcement agencies are facing difficulties in preparing 
themselves for new emerging trends. Such trends are only picked up in advance by 
introducing early warning systems like continuous pro-active environmental or horizon 
scanning in the area of organised crime. Then again, the phenomenon of organised crime will 
not disappear, it will continue to evolve. The challenge faced by law enforcement rather 
refers to the ability to evaluate organised crime activities with regard to the impact of these 
activities. There are no standard measures available that allow to directly measure and 
compare the impact of organised crime it will be necessary to measure the impact of 
organised crime by the use of indicators - indirect measuring. A combined list of common 
indicators, describing the impact of organised crime groups enables the possibility of 
comparing individual organised crime groups allowing for the prioritisation of groups with a 


focus on the identified threat levels. 


What makes the activities of a criminal group more dangerous to society than the activities of 
another one? The SLEIPNIR proj ect”', initiated by the Royal Canadian Mounted Police in 
Canada tried to develop a measurement based on indicators to provide an answer to this 
question for the organised crime situation in Canada.” Project SLEIPNIR identified 

19 indicators with different individual weights, which are used to rank organised crime 
groups with regard to their impact. The higher the final score, the greater the overall impact 
of the organised crime group. SLEIPNIR gives the highest weighting within the list of 
indicators to the ability of an organised crime group to corrupt, to the level of violence used 


by the group and their use of business-like structures. 


*! Simply named after Odin’s hors 


°° §.J. Strang. Project SLEIPNIR: An Analytical Technique for Operational Priority Setting. RCMP [available 
at: https://www.e-education.psu.edu/drupal6/files/sgam/Project% 20SLEIPNIR% 
20An%20Analytical%20Technique%20for%200perational%20Priority%20Setting.pdf] 
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There is no doubt that information related to these three areas is of major importance to 
identify the potential impact of an organised crime group. However, taking a European 
perspective it has been demonstrated that exactly in these areas information available from 
law enforcement agencies in Member States is rather scattered, which is due to the fact that 
there is hardly any related ‘hard data’ available as such information is not required to 
substantiate a crime as defined in national penal codes. It is unlikely that a focus on these 
three indicators provides a homogeneous framework for the evaluation of the individual 
impact of OC groups active in the European Union. Hence, the list of indicators introduced 
for the OCTA is different, reducing the weight of the aforementioned indicators and 
expanding on other indicators. The related information, from a European perspective is easier 


to be obtained and lends itself to a more homogeneous data collection plan. 


Although the collection of qualitative data in Member States needs to be homogeneous there 
are no agreed standards on how such data is collected and included in the national 
contributions from Member States. In addition, there was also no agreed mechanism in place 
with regard to an individual weighting of the indicators on which data is be collected. 

These realities had to be taken into consideration when developing a new methodology for 
the writing of a European Organised Crime Threat Assessment. Consequently, the new 
methodological approach needed to avoid being overambitious to allow for a realistic 
implementation and tangible results. Further adjustments to the methodological concepts 
have to be introduced step by step during the years to come, taking into account the resulting 
evaluation of the existing data collection mechanisms and the potential feasibility of 
introducing such adjustments. A starting point to be able to develop an understanding of the 
developments in organised crime is linked to the scanning of external factors organised crime 
is embedded in. The most relevant influencing external factors are related to political, 
economic, social, technological, environmental, and legislative developments. The analytical 
tool used for this exercise is known as PESTEL analysis.” A PESTEL analysis examines the 
impact of the aforementioned external factors on organised crime (group and phenomenon 
related) and the findings are used to identify potential opportunities for and existing/potential 
threats that could be exploited by organised crime groups. Understanding the organised crime 
environment can be transformed into counter-strategies to reduce the impact of organised 


crime. 


°° See also earlier reference on p. 35 et seq. 
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As it will be difficult to directly measure the impact or respectively the threat posed by 
organised crime activities in the EU indirect measurement enables the analysts to describe 
potential strength, weaknesses, opportunities, and threats (SWOT Analysis) of organised 
crime groups as the main ingredients of a Threat Assessment. PESTEL and SWOT analysis 
are interlinked where PESTEL analysis describes the environmental framework for a SWOT 
analysis which focuses on organised crime groups. Not all opportunities and threats identified 
ina SWOT analysis have a real impact on the threat posed by organised crime groups. Real 
impact depends on the capabilities of organised crime groups to exploit such opportunities or 


to counter possible threats. 


The following chart displays a visual representation of the relationship between PESTEL and 


SWOT Analysis as proposed for the (S)OCTA: 


PEST(EL) Analysis SWOT Analysis 

= external environment: = group/phenomenon 
Political related: 
Economical ¢ Strength 
Social * Weaknesses 
Technological Combine * Opportunities 
Environmental Strength and * Threats 


legal Weaknesses 
with findings | 
| in PEST to identify 
key factors that 


can impact on OC 


evalute Develop key indicators evalute 
to assess 


Opportunities and Threats 
process process 


Analysis and 
Strategic decision making 
¢ Reduce Strength 
* Exploit Weaknesses 
* Minimise Opportunities 
* Follow-up Threats 


Page 127 of 146 


12.1 Other indicators to be used for writing a Threat Assessment 


Law enforcement agencies in Member States provide information related to the 
aforementioned indicators based on existing knowledge. Nevertheless, information available 
from law enforcement agencies only represents a specific and one-dimensional facet of 
information related to organised crime. The basis for writing a comprehensive threat 
assessment is a holistic approach trying to incorporate as many different information sources 
as possible to come up with a consistent and complete evaluation of the situation after the 
analysis of the available information. Understanding developments relevant for organised 
crime requires continuous scanning of the ‘organised crime scene’. Continuous reporting as a 
result of continuous scanning is an important source of information enabling an early warning 
function. Continuous scanning and reporting offers the possibility to identify new emerging 
trends and patterns relevant for an Organised Crime Threat Assessment at an early stage. 
Such a mechanism also provides a framework to monitor and report upon organised activities 
in a structured and systematic format. Implementing such a tool requires a systematic and 
enhanced feed-back mechanism with Member States. Information obtained from the scanning 
process, often based on open sources needs to be evaluated and cross-checked by Member 
States concerned. Only Member States are in a position to finally confirm or refute the 
analysis provided for in this organised crime scan based on the information collected from 


secondary sources. 


To be able to produce a comprehensive European OCTA the data collection phase needs to 
be all-inclusive by incorporating information from as many entities involved in countering 
organise crime activities as possible. This requirement has to be reflected at national and 
trans-national level, within the European Union and outside. Integrating national law 
enforcement agencies is the first step. Law enforcement responsibilities at national level in 
Member States exist at national, regional, and local level, within often independent or semi- 
independent structures and lines-of-command. In addition, law enforcement responsibilities 
are dispersed amongst a variety of different agencies, e.g. police, border police, customs, 
financial/tax authorities. The set-up indicates that available law enforcement information 
which could be used for the production of a European OCTA is very much spread in Member 
States. To paint a realistic picture of the current organised crime situation it is important that 
all available law enforcement information is compiled at national level. Otherwise the 
information to base a threat assessment on is likely to be incomplete, skewed, and 


misleading. 
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It will be necessary for the ECIM to provide added-value to rely on agreed working 
definitions for the concepts of threat, risk, harm, and vulnerability as well as their 
interrelations and their interdependences. For the purpose of the ECIM the following 


definitions are used: 


¢ Harm, Impact, Consequence (used as synonyms) refer to a negative or unwanted effect 


resulting in some kind of damage which can be of a physical or psychological nature; 
¢ Threat is the existing potential of an entity to cause harm; 


¢ Vulnerability is an existing weakness which allows a threat to cause harm, 


to have a negative impact or to result in negative consequences; 


¢ Risk refers to a statement of probability that a threat is able to exploit a vulnerability 


to cause harm, to have a negative impact or to result in negative consequences; 
¢ Probability attributes a level of likelihood to something to happen. 


The relationship between these different terms is displayed in the following chart: 


a Influences 
: on final assessment 
Expectation P 
THREAT 


f(R)=T*V : 
Capability : 
Knowledge - 
VULNER_ |...” 
ABILITY 


As displayed in the chart, a threat is the result of an existing intent combined with an existing 


capability. Both can vary and the product of the two determines the final threat-value. 
Intention is the product of an existing desire (to act) and an existing expectation (to achieve 
something), whereas capability- is composed of existing knowledge (to be able to make 
adequate use of available resources) and existing resources. Vulnerability depends on an 


existing threat and is counter-balanced by existing defence mechanisms. Vulnerability is 
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influenced by the harm a negative impact can inflict. The actual harm is established by using 
a scenario-technique related to identify potential threats. The final outcome, the risk-value is 
the product of the calculated threat-value and the identified vulnerability-level. 

If a serious threat has been identified but at the same time the related vulnerability is close to 


zero because of an existing defence mechanism the overall risk-value will also be low. 


Dealing with existing threats in a vulnerable environment by implementing successful 
counter-strategies and actionable counter-measures is the challenge law enforcement agencies 
and policy decision makers have to face. To achieve this law enforcement agencies and 
policy decision makers have to consider all the individual phases linked to the 
aforementioned process. Phases in this process are interlinked and need to be responded to. 
As mentioned, the first step in the process is to identify an existing threat. A ‘threat can be 
regarded as existing, if there is a confirmed risk that a potential threat is able to exploit an 
existing vulnerability. The final step in the cycle is the successful mitigation of the threat by 


developing an effective counter strategy. The cycle can be described as follows: 
1. Preparation Phase = Gathering available information on potential targets 
2. Qualify critical targets = ‘Understanding’ the identity of the potential targets 
3. Target collation = Clustering of critical assets and potential undesirable events 


4. Threat Identification = Gathering information to determine the possibilities 


of undesirable events to materialise 
5. Impact Assessment = Determining the impact of the potential undesirable events 


6. Vulnerability Assessment = Listing existing counter-measures, determine the 


effectiveness and the weaknesses of these counter-measures 


7. Risk Assessment = Calculating the probability posed by undesirable events in relation 


to the identified threats and existing vulnerabilities 


8. Countermeasure Selection = Identifying measures that could mitigate the identified 


risk 


9. Risk Re-assessment = Reassessing the risk assuming new counter-measures are 


implemented 


10. Security Upgrade = Agreeing on new required counter-measures (including an 


implementation plan and resource allocation) 
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11. Implementation decision = Final agreement on ownership and implementation 


planning (assigning responsibility for implementation) 
12. Implementation Phase = Preparing a schedule for implementing measures as planned 
13. Feed-back and evaluation of the implementation 
14. Adjustments and taking into account new developments/changes in the environment 


The chart below summarises the existing links: 


Risk = the probability of a vulnerability 
to be exploited by a threat 
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The chart related to the relationship of threat, vulnerability, risk and harm is similar to the 
approach taken Vander Beken (2004), which is based on a model presented by J. Brown in 
1998 when addressing the ‘Optimising Open Source information Conference’ in Canberra. 
However, the relationship elaborated by Vander Beken shows different relationships between 


individual components: 
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According to this model risk is the result of a threat combined with harm. This relationship is 
referred to as ‘Risk Assessment Matrix’. Compared to the proposed working definitions and 
the relationship between threat, vulnerability, risk and harm in this thesis the identified 
difference regarding the conceptual approach is fundamental. The ‘Risk Assessment Matrix’ 
does not account for vulnerability as a variable to define risk. Although the analysis 
highlights the importance of sector vulnerability the vulnerability assessment is regarded as 
an independent tool within the strategic approach towards organised crime. For the ECIM and 
the (S)OCTA to work the vulnerability assessment has to be an integral part of the model as 
described in this thesis. On the other hand, the conceptual model chosen by Vander Beken 
emphasises the variable of harm to define the final risk level. Unfortunately, harm is a 
subjective variable which depends on societal and political perception. To integrate harm as a 
significant variable in a conceptual threat assessment model is promoting a model which 
depends on developments that might be completely unrelated to the objective situation. 

In a post-modern society such a model might better be suited to accommodate individual and 
relative positions. If such a model is supposed to be successful at a trans-national level, the 


impact of these positions should be minimised as much as possible. 


The “Dover-Case’ helps to understand the argument. 58 Chinese illegal immigrants were 
found dead in an airtight 18 metre-long container in the back of a lorry at the port of Dover 
on the 19 June 2000. The driver of the Dutch-registered lorry had just made the crossing from 
Zeebrugge, Belgium, when his vehicle was pulled over for a random inspection by a customs 
official. This tragic event dominated the media for the next couple of weeks, highlighting the 
desperate situation faced by asylum-seekers and refugees. The loss of life is undoubtedly the 
most severe harm that a victim of organised crime can suffer. In addition, the fact that in the 
‘Dover case’ the victims must have gone through the worst ordeal adds to the harm inflicted. 
There is also no doubt that everything needs to be done to disrupt such criminal activities to 
protect the life of others. As a consequence of the case tackling illegal immigration from 
China moved up on the priority list to become number one. Every effort was made to be more 
successful in the fight against illegal immigration and trafficking of human beings. 

What was not reflected was the magnitude of these forms of crime from a strategic 
perspective. As tragic as the ‘Dover Case’ was, the strategic assessment regarding illegal 


immigration and trafficking of human beings remained unchanged. The death of 
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58 individuals brought the problem back into the focus of the media and the political decision 
makers based on harm but a decision to change strategic priorities based on singular incidents 
is exactly not what should happen in strategic priority setting. As a matter of fact the 
dimension of the problem of illegal immigration from China was the same before and after 
the Dover case. Harm cannot be neglected but the weight attributed to harm as proposed in 
the ‘Risk Assessment Matrix’ invites skewed decision making. 15 years later, Chinese and 
Asian organised crime groups have continued to manifest their positions in other multi-crime 
areas with trafficking in human beings still a major trade. The involvement in Cocaine 
smuggling from South America via West Africa due to the increase of Chinese economic 
interests in the region just being one example. The Dover case and the focus on harm in 
strategic priority setting did not change the impact of law enforcement activities in the related 
organised crime activities. The basis for a long-term strategic planning tool like the ECIM is 
having an independent threat assessment methodology in place that is independent from 
tactical considerations and not driven by short-lived political interests is. Conceptualising the 
concept at European and national law enforcement level is a key factor for the 


implementation of the ECIM. 
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13. Conclusion 


As a result of a stronger Europeanisation in trans-national law enforcement cooperation since 
the Treaty of Nice the European Criminal Intelligence Model (ECIM) is regarded as a 
milestone to prioritise, harmonise, and coordinate the fight against organised crime in the EU. 
By moving towards a more prominent role at EU level law enforcement agencies in Member 
States have to adjust the current framework of trans-national cooperation in the light of these 
developments. It is impossible to separate national from trans-national law enforcement when 
addressing counter-strategies to tackle organised crime. Organised crime investigated at 
national level also has a trans-national dimension that needs to be taken into account if 
counter-measures are to be effective. As a consequence, the ECIM and national law 


enforcement perspective have to be aligned. 


The ECIM is based on the concept of ‘intelligence-led policing’ as a pro-active approach to 
enable law enforcement to be in the driver’s seat when being challenged by organised crime. 
There is a basic concern regarding the use of ‘intelligence’ for the ECIM. Using the concept 
of intelligence in policing is not new but the concept of intelligence in policing also is 
disputed. There is no universally agreed definition of what constitutes intelligence in a law 
enforcement context and the term cannot be found referenced to in any of the national penal 
codes or codes of criminal procedures in Member States. The focus on intelligence can be 
misleading, moving the ECIM in an unwanted direction, away from the self-perception of 
traditional law enforcement based on a modern understanding of our societies. This magnifies 
the difficulties for the use of the concept of intelligence, especially when used in a trans- 
national context. Bridging this gap remains a major challenge for the ECIM and only possible 
if the ECIM can demonstrate that the model is able to translate strategic findings into 
operational activities, providing a real added value to law enforcement agencies in Member 
States. From this perspective it would be advisable to relate the ‘I’ in the ECIM rather to 
information than to intelligence, even if the intelligence component is regarded to be an 
integral part of the exercise. The emphasis of the ECIM should be on the analysis of available 
information (be it ‘hard’ or ‘soft’ information) and the subsequent assessment of this 
information without predetermined outcome. The ECIM has to free itself from being mainly a 


political tool owned by the political decision makers in Brussels. 
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On the other hand, restricting the ECIM to information reduces its usefulness. Relying on 
information (or facts) is very much attributed to modern law enforcement. The thesis has 
demonstrated that the ECIM as a tool for strategic decision making and priority setting is of 
better use if the model can rely on interpretative data (intelligence) which allows for an 
understanding of phenomenon or group related organised crime. Only understanding 
organised crime enables a holistic perspective to develop successful and ‘sustainable’ 
counter-strategies against organised crime which make the difference. Law enforcement 
agencies in Member States and Europol as the responsible entity to produce the (S)OCTA 


have to come to a final agreement on the actual ‘I’ in the ECIM. 


A holistic ECIM also requires to broaden the variety of sources used. The former exclusive 
role of law enforcement in tackling organised crime has changed and additional players have 
‘entered the game’. In this context it is vital to accept that looking at organised crime form a 
different perspective does not water down the focus, on the contrary different perspectives if 
integrated and analysed within the ECIM add additional dimensions to the understanding of 
organised crime. In a societal set-up that is evolving beyond the classic modern paradigm 
such multi-dimensional are not only a given fact they also add to the ability of the ECIM to 


provide tailored strategic guidance. 


It cannot be ignored that criminal investigations are set-up within a national framework. 
National interests in law enforcement will be the dividing line for the success or the failure of 
the ECIM for the foreseeable future. In the same way that national law enforcement has to 
adapt to the ECIM the ECIM has to consider the national perspective. Otherwise the ECIM 
continues to be regarded as a theoretical exercise that has no impact on how trans-national 


organised crime is tackled at operational level. 


The concept of the ECIM goes back to Radcliff’s 3-i-model as the basic concept of 
intelligence-led-policing. Looking at the complexity of the ECIM the 3-i-model does not 
provide enough detail. As the ECIM is intended to serve as a holistic approach including non- 
law-enforcement information and/or intelligence, the 3i-model has to be extended to reflect 
the relationship amongst these additional players. The extended 3i-model shows that the 
successful implementation of the ECIM will depend on more than integrating law 
enforcement agencies at Member State level into the process of strategic decision making at 
European level. This inter-disciplinary integration is a fundamental prerequisite for 


successfully implementing the ECIM. 
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The ECIM is based on ‘all-source’ intelligence (if the emphasis on intelligence remains) 
which requires that the ECIM is referred to as an intelligence-model focusing on the criminal 
environment and not an intelligence-model based on criminal-intelligence only. The focus on 
the latter would limit the value of the ECIM as a holistic tool. Law enforcement in Member 
States has to understand that tackling organised is not an exclusive domain anymore. 

Too many other actors from other sectors are able to contribute to a European Criminal 
Intelligence Model. Only if law enforcement accepts that these information sources are 
included into the process the ECIM is able to produce a holistic trans-national perspective on 
organised crime which might be different from a perspective driven by the need show 


immediate tangible results. 


Once successfully implemented the ECIM will fundamentally change the trans-national fight 
against organised crime in the European Union. With the ratification of the Lisbon Treaty in 
2009 it was only a question of time until trans-national law enforcement as part of the former 
‘third pillar’ would also undergo a major change. The ECIM tips balance towards the 
European Union or more precisely Europol as the EU’s main law enforcement agency. 
Already in the early years of its existence Europol was tasked to take a strategic European 
perspective on organised crime with the aim to develop a more orchestrated European 
approach taking into account the fact that the most successful organised crime groups operate 
at a trans-national level. However, law enforcement agencies in Member States belittled these 
efforts as there was never a real link between these strategic findings and operational 
activities at Member State level. The ECIM, establishing this link will put Europol in the 
driver’s seat. Member States will have to align their national operational priorities with the 


strategic priorities established at European level. 


Project Harmony, outlining the necessary steps to be taken to implement the ECIM is the 
most current attempt at national and European level. The Project Harmony action plan 
assumes that Member States will adapt their current law enforcement structures to centre 
their operational activities in line with the strategic finding presented in the Serious and 
Organised Crime Threat Assessment (S)OCTA) as the strategic product which priorities these 
operational activities. An ECIM will only function if Member States are prepared to mirror 
ECIM requirements at national level. To do so, Member States have to introduce a 

National Intelligence Model which might be different to established law enforcement 
approaches. There remains a question mark to which extent Member States are prepared to 


accept such a change. Two main reasons for questioning this readiness being: (a) even with 
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the Lisbon Treaty national law enforcement remains at the core of each individual Member 
State primarily defining national perspectives and priorities, and (b) the fact that the ECIM as 
an overarching model to effectively tackle organised crime is closely linked to a modern 
understanding of the world - the ability to provide a grand-narrative which is able to address 
the challenges of organised crime by a single concept. Such a one-dimensional approach 
would not fit in a post-modern society, which is characterised by promoting a more scattered 
reality requesting more individually tailored approaches depending on constantly changing 
variables which again require frequent adoption and change. Although this thesis was not 
able to clearly answer the question if the modern society has moved to a post-modern society 
or is transforming into such a society it has been demonstrated that a solely modern based 
perspective for law enforcement does not reflect the current situation. The monolithic concept 
of the police being the only legitimate entity empowered to enforce the law in line with a 
Weberian nation-state concept has at least shown some cracks over the last decades. 

In addition, today’s law enforcement agencies haves become much more than what is 
understood by traditional policing. In this context it does not matter if post-modernity will 
supersede modernity or if post-modernity is simply an evolutionary step within modernity. 
The mid and long-term consequences for the ECIM will be the same: a monolithic ECIM will 
not be the long-awaited law enforcement response to effectively tackle organised crime. By 
introducing the concept of regional hubs the OCTA has moved towards a more postmodern 
understanding of organised crime, highlighting the importance of regional differences as a 
decisive factor for defining strategic priorities. With the new SOCTA approach focusing on 
‘behavioural patterns’ of organised crime postmodern thinking has been further incorporated 
into the ECIM concept. To successfully translate these developments into the national law 
enforcement perspective the role of National Intelligence Models aligned with the ECIM 


cannot be underlined enough. 


Law enforcement in Europe needs to be transformed to provide an effective and in an ideal 
situation even efficient response to tackle organised crime and to prevent organised crime 
groups from subverting legal structures in Member States. The ECIM is a move in the right 
direction as the ECIM tries to take a holistic perspective of the problem. If the ECIM is to be 
successful the underlying principles have to be understood and accepted by all Member 
States. Project Harmony provides a blue-print for such an approach. However, so far the 
ECIM is promoted only by a small number of Member States and the Road Map covering the 


period from 2011 to 2017 is not sufficient to achieve the necessary rethinking, especially 
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taking into account that currently the European Union is more characterised by increased 


diversity rather than unity at national, regional and local level. 


Before the ECIM can be successful there needs to be a different road map that outlines the 
necessary steps to lay the foundations for a paradigm shift in European policing. 

This must show the added value for Member States and national law enforcement agencies 
when following a common model, the ECIM rather than relying on well-established 
mechanisms which are centred around primarily national interests, representing a concept 
focusing on established “comfort zones’ of law enforcement. Comfort zones in a post-modern 
setting vanish to exist and are constantly challenged by an evolving Europeanization or even 


globalization. Organised crime has given up the ‘nation state perspective’ decades ago. 


New upcoming questions linked to the operational use of intelligence, like possible data 
protection requirements and accountability need to be carefully considered, especially if the 
ECIM is supposed to close the gap between strategic findings at European level and 
operational activities in Member States. Intelligence exchanged across national boundaries 
has an impact on the individuals concerned. There needs to be a judicial framework that 
guarantees that intelligence is used in line with existing regulations due to different national 
legislation in Member States, which provides law enforcement with different tools impacting 


on human rights. 


The ECIM as a holistic model, accommodating regional differences and priorities without 
insisting on a ‘one size fits all’ approach can provide the framework to tackle organised crime 
more effectively and more efficiently but it needs to be embraced at national level by 
overcoming national egoism. This flexible approach is also the logical consequence of a 
societal framework that is moving beyond the traditional standards generally referred to as 


modernity. 
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Annex - Questionnaire 


PHD Interview Questionnaire - Implementing an ECIM 


Used for semi-structured interviews (Senior Officers) 


1. What is your understanding of the word ‘intelligence’ in a law enforcement 
environment? 


2. How do you translate the word ‘intelligence’ in your country in a law enforcement 
context? 


3. How do you distinguish between ‘information’ and ‘intelligence’? 


a. Is ‘information’ treated different from ‘intelligence’? How? 


b. What does this mean for the exchange of ‘information’ and ‘intelligence’ with 
other countries? 


4. Do you exchange ‘intelligence’ with other countries in the EU? 


a. How is the exchange done? 


b. Is the exchange of ‘intelligence’ institutionalised? 


c. Is the exchange of ‘intelligence’ standardised? 


d. How is the exchange of ‘intelligence safeguarded? 


e. Is the purpose for using ‘intelligence’ when exchanged specified? 


f. How is this done? 


g. Is there a follow-up mechanism for ‘intelligence’ exchanged (e.g. in case 
additional intelligence is available or the intelligence provided has lost its value) 


5. How do you use ‘intelligence’ to prioritise crime areas/criminal groups? 
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Do you have a national criminal intelligence model and what is the conceptual 
framework for such a model, if in existence? 


7. What is your understanding of a European Criminal Intelligence Model? 
8. How do you define national strategies to combat organized crime? 
9. How do you establish priorities? 
a. Who is involved in this process? 
10. In which frequency are these strategies elaborated? 
11. What are the most influencing factors for prioritizing criminal groups regarding law 
enforcement activities? 
12. What are the most influencing factors for prioritizing crime areas regarding law 
enforcement activities? 
13. To which extent influences the EU Organised Crime Threat assessment your 
prioritisation of law enforcement activities at national/regional/local level? 
14. To which extent do developments in other countries influence your national 
priorities? 
15. Do you coordinate your priorities in combating organised crime beyond the national 
level? How and with whom? 
16. How has trans-national policing developed over the last 10 years? 
a. What has been the most striking development in trans-national policing during 
the last 10 years? 
17. If there was a mechanism at EU level to coordinate the efforts to combat organised 
crime how should such a mechanism look like? 
a. What would you expect from such a mechanism? 
18. How far should such a mechanism interfere with your national prioritisation 
mechanism? 
19. Any other remark linked to the questions above? 
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